Intermediate
Open
Free
What Happens the First Time a Sandboxed Command Reaches a New Domain
You've enabled sandboxing so Bash commands can only write to the working directory/temp dir and reach allowlisted domains. A command tries to reach a domain that isn't on the allowlist yet.
What happens?
Solution
The correct answer is "It prompts you for approval on that new domain."
The sandbox is designed so a first-time reach to a new domain surfaces an approval prompt, after which sandboxed commands can run without one. It isn't silently allowed once and blocked afterward, it doesn't fail with no path to approval, and reaching an unallowlisted domain doesn't disable the whole sandbox — the restriction that matters (only the working directory, temp dir, and allowlisted domains) stays in force the entire time.
Share this question