sandbox-pentest-assessment

Authorized, read-only Linux sandbox boundary assessment.

Runs during preinstall so a privileged package-install path can be assessed. It inventories identity, namespaces, UID/GID mappings, capabilities/security controls, mounts, PID 1, cgroups, processes, network interfaces/routes/listeners, devices, runtime sockets, SUID/SGID files, file capabilities, writable directories, security modules, and environment variable names (values are not collected).

Raw evidence is stored root-only under /tmp/sandbox-pentest-<pid>/. A sanitized inventory containing no environment values is also written to /tmp/sandbox-pentest-latest.txt and /tmp/sandbox-pentest-latest.json with mode 0644 so the unprivileged sandbox user can retrieve the assessment.

No persistence, reverse shells, credential collection, cross-tenant access, destructive writes, namespace/mount/cgroup/device/security-policy changes, runtime API calls, or kernel/container escape exploits are performed.