External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Sandbox policy tuning for tmp write access (#145)

Browse Source 
* fix: Sandbox policy tuning for tmp write access

* fix: Remove numbers from test

* Update sandbox/profiles/pnpm-restrictive.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* fix: Sandbox E2E test to consider Linux bubblewrap tmpfs mount

* Update sandbox/profiles/pnpm-restrictive.yml

Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* fix: Migrate deny rules from pnpm to npm policy

---------

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
This commit is contained in:
Abhisek Datta
2026-02-01 15:20:17 +05:30
committed by GitHub
co-authored by Copilot Sahil Bansal
parent b332e1d6d4
commit 4600ab0245
9 changed files with 354 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/util/dangerous.go
+12 -5
View File
@@ -58,16 +58,23 @@ func GetMandatoryDenyPatterns(allowGitConfig bool) []string {
}
}
// Git hooks are ALWAYS blocked for security (can execute arbitrary code)
// Git hooks are blocked in CWD and HOME for security (can execute arbitrary code)
// We don't use global globs like **/.git/hooks to allow legitimate temp dir operations
// (e.g., npx cloning repos to /tmp)
patterns = append(patterns, filepath.Join(cwd, ".git/hooks"))
patterns = append(patterns, filepath.Join(cwd, ".git/hooks/**"))
patterns = append(patterns, "**/.git/hooks")
patterns = append(patterns, "**/.git/hooks/**")
// Git config is conditionally blocked
if home != "" {
patterns = append(patterns, filepath.Join(home, ".git/hooks"))
patterns = append(patterns, filepath.Join(home, ".git/hooks/**"))
}
// Git config is conditionally blocked in CWD and HOME
if !allowGitConfig {
patterns = append(patterns, filepath.Join(cwd, ".git/config"))
patterns = append(patterns, "**/.git/config")
if home != "" {
patterns = append(patterns, filepath.Join(home, ".git/config"))
}
}
return patterns