External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Tune pypi sandbox profile (#178)

Browse Source
This commit is contained in:
Abhisek Datta
2026-03-06 17:47:04 +05:30
committed by GitHub
parent 2bb5dd3778
commit 0588e66131
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/profiles/pypi-restrictive.yml
+9 -1
View File
@@ -14,6 +14,10 @@ allow_pty: true
filesystem: filesystem:
allow_read: allow_read:
# Root read is required for shims (e.g., asdf, pyenv) that traverse the filesystem.
# This is safe because deny rules have higher precedence and dangerous files
# (.env, .ssh, .aws, .gnupg, etc.) are blocked by mandatory deny patterns.
- /
- ${CWD}/** - ${CWD}/**
- ${HOME}/.config/pip/** - ${HOME}/.config/pip/**
- ${HOME}/.pip/** - ${HOME}/.pip/**
@@ -43,6 +47,7 @@ filesystem:
- ${HOME}/.cache/pypoetry/** - ${HOME}/.cache/pypoetry/**
- ${HOME}/.cache/poetry/** - ${HOME}/.cache/poetry/**
- ${HOME}/.cache/uv/** - ${HOME}/.cache/uv/**
- ${HOME}/Library/Caches/pip/**
- ${HOME}/.local/lib/python*/** - ${HOME}/.local/lib/python*/**
# Additional deny rules (optional - credentials are automatically blocked) # Additional deny rules (optional - credentials are automatically blocked)
@@ -73,8 +78,11 @@ process:
- /usr/bin/gcc - /usr/bin/gcc
- /usr/bin/clang - /usr/bin/clang
- /usr/bin/git - /usr/bin/git
# Required for shims (e.g., asdf) that use #!/usr/bin/env bash
- /bin/bash
- /bin/sh
- /usr/bin/env
deny_exec: deny_exec:
- /usr/bin/curl - /usr/bin/curl
- /usr/bin/wget - /usr/bin/wget
- /bin/bash