nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`
Date: 2026-05
Affected: rust/nono-cli
Attack vector: sandbox-escape
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-47128
CWE: CWE-863
CVSS: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L)

### Summary The nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Threat scenario: Running Aider, Claude Code, OpenCode or similar tools with "allow bash" policy so that it can invoke arbitrary host tools like `make`, `gcc`, etc. to write code. ### Reproducer Here, instead of running a tool like `opencode` or `claude` one can just invoke `systemd-run`, but this is something an agent could be tricked into doing: ```bash $ cd ~/src/myproject $ nono run -s --allow-cwd --profile claude-code -- \ systemd-run --user -q --wait --collect \ /bin/sh -c "echo oops > ~/Documents/escaped.txt" $ cat /var/home/test/Documents/escaped.txt oops $ ``` ### Impact Complete sandbox escape. The unsandboxed sibling process can write anywhere the user can write, spawn arbitrary processes with network access, etc. ### Maintainer Context This issue allows a process running inside the sandbox to escape confinement by interacting with local user-scoped IPC mechanisms and regain the authority already held by the invoking user or service account. The issue impacts the sandbox’s confinement and blast-radius reduction guarantees for agents and sandboxed tooling. However, exploitation does not provide privilege escalation, cross-user access, or host compromise beyond the permissions already available to the launcher outside the sandbox. This issue affects th


Mitigations:

Architectural layers (MAESTRO):