mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
chore: Cleanup sandbox policy
This commit is contained in:
@@ -8,28 +8,10 @@ This directory contains built-in sandbox policies for PMG package managers.
|
||||
|
||||
Restrictive policy for the npm ecosystem (npm, pnpm, yarn, bun).
|
||||
|
||||
**Features:**
|
||||
- Allows read access to current directory, package manager configs, and caches
|
||||
- Restricts write access to `node_modules/` and lockfiles only
|
||||
- Blocks access to sensitive files (`~/.ssh`, `~/.aws`, `.env` files)
|
||||
- Allows network access to npm registries only
|
||||
- Permits Node.js and git execution, blocks shell and curl/wget
|
||||
|
||||
**Use when:** You want balanced protection for npm package installations
|
||||
|
||||
### pypi-restrictive
|
||||
|
||||
Restrictive policy for the PyPI ecosystem (pip, pip3, poetry, uv).
|
||||
|
||||
**Features:**
|
||||
- Allows read access to current directory, pip configs, and caches
|
||||
- Restricts write access to virtual environments and package caches
|
||||
- Blocks access to sensitive files (`~/.ssh`, `~/.aws`, `.env` files)
|
||||
- Allows network access to PyPI registries only
|
||||
- Permits Python, compilers (for native extensions), and git
|
||||
|
||||
**Use when:** You want balanced protection for pip package installations
|
||||
|
||||
## Custom Policies
|
||||
|
||||
You can create custom sandbox policies by:
|
||||
@@ -55,7 +37,6 @@ See the [Policy Schema Documentation](../policy.go) for details on the YAML stru
|
||||
|
||||
- `${HOME}`: User home directory
|
||||
- `${CWD}`: Current working directory
|
||||
- `${PM_CACHE}`: Package manager cache directory
|
||||
- `${TMPDIR}`: Temporary directory
|
||||
|
||||
### Violation Modes
|
||||
|
||||
Reference in New Issue
Block a user