claude-test.json

{
  "meta": {
    "name": "claude-test",
    "version": "1.0.0"
  },
  "extends": "claude-code",
  "filesystem": {
    "allow": [
      "$HOME/dev/salt-setupify"
    ],
    "read": [],
    "write": [],
    "read_file": [
      "$HOME/.global_ignore"
    ],
    "allow_file": []
  },
  "policy": {
    "add_deny_access": [
      "$HOME/dev/salt-setupify/.tmp/reclass",
      "$HOME/dev/salt-setupify/.ssh",
      "$HOME/dev/salt-setupify/compose",
      "$HOME/dev/salt-setupify/clone.sh"
    ]
  }
}

logs

bruno@k-wrk-1:~/dev/salt-setupify $ nono run --allow-cwd --profile claude-test -- cat /home/bruno/dev/salt-setupify/Makefile 

  nono v0.45.0
2026-04-30T14:04:41.013592Z  WARN Landlock cannot enforce deny '/home/bruno/dev/salt-setupify/.tmp/reclass' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile). This deny has no effect on Linux.
2026-04-30T14:04:41.013625Z  WARN Landlock cannot enforce deny '/home/bruno/dev/salt-setupify/.ssh' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile). This deny has no effect on Linux.
2026-04-30T14:04:41.013648Z  WARN Landlock cannot enforce deny '/home/bruno/dev/salt-setupify/compose' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile). This deny has no effect on Linux.
2026-04-30T14:04:41.013665Z  WARN Landlock cannot enforce deny '/home/bruno/dev/salt-setupify/clone.sh' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile). This deny has no effect on Linux.
2026-04-30T14:04:41.013708Z ERROR Sandbox initialization failed: Landlock deny-overlap is not enforceable on Linux. Refusing to start with conflicting policy.
Remove the broad allow path, remove the deny path, or restructure permissions.
Conflicts:
- deny '/home/bruno/dev/salt-setupify/.ssh' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)
- deny '/home/bruno/dev/salt-setupify/.tmp/reclass' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)
- deny '/home/bruno/dev/salt-setupify/clone.sh' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)
- deny '/home/bruno/dev/salt-setupify/compose' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)
nono: Sandbox initialization failed: Landlock deny-overlap is not enforceable on Linux. Refusing to start with conflicting policy.
Remove the broad allow path, remove the deny path, or restructure permissions.
Conflicts:
- deny '/home/bruno/dev/salt-setupify/.ssh' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)
- deny '/home/bruno/dev/salt-setupify/.tmp/reclass' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)
- deny '/home/bruno/dev/salt-setupify/clone.sh' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)
- deny '/home/bruno/dev/salt-setupify/compose' overlaps allowed parent '/home/bruno/dev/salt-setupify' (source: profile)