sandbox: minor review follow-ups on --confine-reads

- standalone llama-server: consume --confine-reads too (sibling of --unsecure),
  so it doesn't reach common_params_parse() and error out.
- warn when --confine-reads is passed to a non-server mode, where it's a no-op,
  instead of silently ignoring it.
- show --confine-reads (and --unsecure) in `--server --help`, which previously
  listed none of llamafile's own server flags.
- capture errno before common_log_resume() on the pledge-failed path so the
  error message can't print a stale errno.
- fix a stale comment on llamafile_sandbox_apply().

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aittalam

llama.cpp.patches/patches/tools_server_server.cpp.patch

@@ -54,7 +54,7 @@ diff --git a/tools/server/server.cpp b/tools/server/server.cpp
      common_init();
 
      if (!common_params_parse(argc, argv, params, LLAMA_EXAMPLE_SERVER)) {
-@@ -297,6 +316,85 @@ int llama_server(int argc, char ** argv) {
+@@ -297,6 +316,86 @@ int llama_server(int argc, char ** argv) {
              llama_backend_free();
          };
 
@@ -122,10 +122,11 @@ diff --git a/tools/server/server.cpp b/tools/server/server.cpp
 +            char promises[64];
 +            common_log_pause(common_log_main());
 +            int sandbox = llamafile_sandbox_server(&spec, promises, sizeof(promises));
++            int sandbox_errno = errno;  // capture before resume() spawns a thread
 +            common_log_resume(common_log_main());
 +            if (sandbox == LLAMAFILE_SANDBOX_FAILED) {
 +                SRV_ERR("sandbox: pledge failed: %s; retry with --unsecure to disable sandboxing\n",
-+                        strerror(errno));
++                        strerror(sandbox_errno));
 +                clean_up();
 +                return 1;
 +            } else if (llamafile_sandbox_is_active(sandbox)) {
@@ -140,7 +141,7 @@ diff --git a/tools/server/server.cpp b/tools/server/server.cpp
          // start the HTTP server before loading the model to be able to serve /health requests
          if (!ctx_http.start()) {
              clean_up();
-@@ -332,6 +430,13 @@ int llama_server(int argc, char ** argv) {
+@@ -332,6 +431,13 @@ int llama_server(int argc, char ** argv) {
              // this will unblock start_loop()
              ctx_server.terminate();
          };
@@ -154,7 +155,7 @@ diff --git a/tools/server/server.cpp b/tools/server/server.cpp
      }
 
      // TODO: refactor in common/console
-@@ -368,6 +473,11 @@ int llama_server(int argc, char ** argv) {
+@@ -368,6 +474,11 @@ int llama_server(int argc, char ** argv) {
      } else {
          SRV_INF("server is listening on %s\n", ctx_http.listening_address.c_str());
 
@@ -166,7 +167,7 @@ diff --git a/tools/server/server.cpp b/tools/server/server.cpp
          // optionally, notify router server that this instance is ready
          std::thread monitor_thread;
          if (child.is_child()) {
-@@ -392,5 +502,54 @@ int llama_server(int argc, char ** argv) {
+@@ -392,5 +503,56 @@ int llama_server(int argc, char ** argv) {
          }
      }
 
@@ -204,6 +205,8 @@ diff --git a/tools/server/server.cpp b/tools/server/server.cpp
 +    // via parse_llamafile_args instead)
 +    if (llamafile_consume_flag(&argc, argv, "--unsecure"))
 +        FLAG_unsecure = true;
++    if (llamafile_consume_flag(&argc, argv, "--confine-reads"))
++        FLAG_confine_reads = true;
 +
 +    // Initialize GPU support early (must happen BEFORE llama_backend_init())
 +    // This triggers dynamic loading of GPU backends (CUDA, ROCm, Metal)

llamafile/main.cpp

@@ -207,6 +207,8 @@ static void print_server_help(bool show_full_list_hint) {
            "  --host ADDR      ip address to listen on (default 127.0.0.1)\n"
            "  --port N         tcp port to listen on (default 8080)\n"
            "  --api-key KEY    require this API key for authentication\n"
+           "  --confine-reads  restrict file reads to the weights directories\n"
+           "  --unsecure       disable pledge() sandboxing (Linux/OpenBSD)\n"
            "\n");
     if (show_full_list_hint) {
         printf("all other llama.cpp options are also accepted.\n"
@@ -397,7 +399,11 @@ int main(int argc, char **argv) {
     if (llamafile_has(argv, "--help") || llamafile_has(argv, "-h")) {
         switch (args.mode) {
             case lf::ProgramMode::SERVER:
-                break; // fall through to llama.cpp's server help
+                // Show llamafile's own server flags (which are stripped before
+                // llama.cpp sees them, so its parser can't list them) before
+                // falling through to llama.cpp's server help.
+                print_server_help(false);
+                break;
             case lf::ProgramMode::AUTO:
                 // Combined mode: args go to the HTTP server, so show the
                 // llamafile intro followed by llama.cpp's server option list.
@@ -469,6 +475,12 @@ int main(int argc, char **argv) {
         args.llama_argv = quiet_argv.data();
     }
 
+    // --confine-reads only affects the --server sandbox. In the other modes
+    // (including the default combined mode, whose sandbox is skipped) it does
+    // nothing, so say so rather than silently ignoring it.
+    if (FLAG_confine_reads && args.mode != lf::ProgramMode::SERVER)
+        fprintf(stderr, "warning: --confine-reads only applies to --server mode; ignoring\n");
+
     // Initialize GPU support (triggers dynamic loading of GPU backends)
     llamafile_has_gpu();
 

llamafile/sandbox.c

@@ -126,9 +126,10 @@ static int sandbox_install_pledge(const char *promises) {
 #endif
 }
 
-// Installs the pledge() sandbox unconditionally (no policy gate). Threads
-// created after this call inherit it. Used by the unit test and by the gated
-// entry points below.
+// Installs the pledge() sandbox unconditionally, skipping the --unsecure/GPU
+// policy gate (the gated entry points share sandbox_install_pledge() directly
+// instead). Exposed for the unit test, which drives the promise sets in a
+// forked child without the gate.
 int llamafile_sandbox_apply(const char *promises) {
     if (!llamafile_sandbox_supported())
         return LLAMAFILE_SANDBOX_UNSUPPORTED;