[BUG] aarch64 linux (al2023) bash tool process spawning completely broken

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/35454
2. https://github.com/anthropics/claude-code/issues/35986
3. https://github.com/anthropics/claude-code/issues/36529

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

Update: confirmed NOT architecture-specific — also broken on x86_64.

Tested on a second instance (m8a.8xlarge, x86_64, same AL2023 kernel 6.1.163) — identical behavior. Bash tool hangs, never reaches execve.

Additional testing:

• PTY allocation works fine (python3 pty.openpty(), script -qc)
• Node.js child_process.execSync('echo hello') works fine
• No seccomp, no NoNewPrivs, no capability restrictions on the Claude process
• Stripping all Coder env vars doesn't help
• Running from a clean env -i with only essential vars doesn't help
• --bare flag doesn't help
• Both 2.1.81 and 2.1.72 are affected

Both instances run inside Coder workspaces (Coder agent v2.31.5, SSH tunneled via Coder relay). The SSH_CONNECTION shows 0.0.0.0 0 0.0.0.0 0 and tty returns "not a tty" — this is Coder's SSH proxy, not a direct SSH connection.

The common factor is the Coder agent execution environment, not architecture or kernel version.

Further investigation — also broken via SSM (not Coder-specific)

Testing via AWS SSM Session Manager (real PTY, not Coder SSH) — Bash tool still hangs. So the Coder agent environment is NOT the cause.

Key finding on landlock:

• Kernel 6.1.163 on AL2023 has CONFIG_SECURITY_LANDLOCK=y
• cat /sys/kernel/security/lsm shows landlock in the chain
• dmesg shows landlock: Up and running.
• Landlock syscalls work — landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION) returns ABI version 2
• BUT: /sys/kernel/security/landlock/ directory does not exist (no abi_version file)
• Kernel boot params: security=selinux — SELinux is the primary LSM

This is a quirk of AL2023's kernel config: landlock is functional at the syscall level but its securityfs interface is not exposed. If Claude Code checks for /sys/kernel/security/landlock/abi_version to detect landlock support vs using the syscall directly, there could be a mismatch causing unexpected behavior.

Other findings:

• subprocess.Popen(["/bin/bash", "-c", "echo hello"], ...) works fine from Python
• child_process.execSync("echo hello") works fine from system Node.js
• The Claude binary's embedded Node runtime never calls execve (confirmed via strace on both arches)
• Debug flag (-d) produces no output before the timeout
• sandbox.enabledPlatforms: [] in settings.json has no effect
• --bare flag has no effect

The binary appears to enter its Bash tool code path but never reaches the point of actually forking a child process.

Root cause found — not a Claude Code bug.

A bootstrap module was installing /etc/profile.d/knock-zsh.sh containing:

if [ -x /bin/zsh ] && [ -z "$ZSH_VERSION" ]; then
    exec /bin/zsh -l
fi

This exec replaces bash with zsh whenever bash sources /etc/profile.d/. When Claude Code spawns bash for the Bash tool, profile.d fires, bash gets replaced by zsh, and the tool never gets control back.

Fix: Use chsh -s /bin/zsh ec2-user instead to set the login shell properly without interfering with non-interactive bash sessions.

Closing as user error. Sorry for the noise!

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.