External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Seatbelt translator handle glob

Browse Source
This commit is contained in:
Abhisek Datta
2026-01-09 19:00:19 +05:30
parent 9cb5345bd6
commit 65753ebc13
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/platform/seatbelt_translator_darwin.go
+6 -7
View File
@@ -5,7 +5,6 @@ package platform
import ( import (
"fmt" "fmt"
"path/filepath"
"strings" "strings"
"github.com/safedep/pmg/sandbox" "github.com/safedep/pmg/sandbox"
@@ -77,7 +76,7 @@ func (t *seatbeltPolicyTranslator) translateFilesystem(policy *sandbox.SandboxPo
// Handle glob patterns vs literal paths // Handle glob patterns vs literal paths
if util.ContainsGlob(expanded) { if util.ContainsGlob(expanded) {
// For glob patterns, use subpath with the base directory // For glob patterns, use subpath with the base directory
baseDir := filepath.Dir(strings.TrimSuffix(expanded, "/**")) baseDir := strings.TrimSuffix(expanded, "/**")
sb.WriteString(fmt.Sprintf("(allow file-read* (subpath \"%s\"))\n", baseDir)) sb.WriteString(fmt.Sprintf("(allow file-read* (subpath \"%s\"))\n", baseDir))
} else { } else {
sb.WriteString(fmt.Sprintf("(allow file-read* (subpath \"%s\"))\n", expanded)) sb.WriteString(fmt.Sprintf("(allow file-read* (subpath \"%s\"))\n", expanded))
@@ -94,7 +93,7 @@ func (t *seatbeltPolicyTranslator) translateFilesystem(policy *sandbox.SandboxPo
} }
if util.ContainsGlob(expanded) { if util.ContainsGlob(expanded) {
baseDir := filepath.Dir(strings.TrimSuffix(expanded, "/**")) baseDir := strings.TrimSuffix(expanded, "/**")
sb.WriteString(fmt.Sprintf("(allow file-write* (subpath \"%s\"))\n", baseDir)) sb.WriteString(fmt.Sprintf("(allow file-write* (subpath \"%s\"))\n", baseDir))
} else { } else {
sb.WriteString(fmt.Sprintf("(allow file-write* (subpath \"%s\"))\n", expanded)) sb.WriteString(fmt.Sprintf("(allow file-write* (subpath \"%s\"))\n", expanded))
@@ -112,7 +111,7 @@ func (t *seatbeltPolicyTranslator) translateFilesystem(policy *sandbox.SandboxPo
} }
if util.ContainsGlob(expanded) { if util.ContainsGlob(expanded) {
baseDir := filepath.Dir(strings.TrimSuffix(expanded, "/**")) baseDir := strings.TrimSuffix(expanded, "/**")
sb.WriteString(fmt.Sprintf("(deny file-read* (subpath \"%s\"))\n", baseDir)) sb.WriteString(fmt.Sprintf("(deny file-read* (subpath \"%s\"))\n", baseDir))
} else { } else {
sb.WriteString(fmt.Sprintf("(deny file-read* (subpath \"%s\"))\n", expanded)) sb.WriteString(fmt.Sprintf("(deny file-read* (subpath \"%s\"))\n", expanded))
@@ -126,7 +125,7 @@ func (t *seatbeltPolicyTranslator) translateFilesystem(policy *sandbox.SandboxPo
} }
if util.ContainsGlob(expanded) { if util.ContainsGlob(expanded) {
baseDir := filepath.Dir(strings.TrimSuffix(expanded, "/**")) baseDir := strings.TrimSuffix(expanded, "/**")
sb.WriteString(fmt.Sprintf("(deny file-write* (subpath \"%s\"))\n", baseDir)) sb.WriteString(fmt.Sprintf("(deny file-write* (subpath \"%s\"))\n", baseDir))
} else { } else {
sb.WriteString(fmt.Sprintf("(deny file-write* (subpath \"%s\"))\n", expanded)) sb.WriteString(fmt.Sprintf("(deny file-write* (subpath \"%s\"))\n", expanded))
@@ -179,7 +178,7 @@ func (t *seatbeltPolicyTranslator) translateProcess(policy *sandbox.SandboxPolic
if util.ContainsGlob(expanded) { if util.ContainsGlob(expanded) {
// For glob patterns, use subpath to allow anything under that directory // For glob patterns, use subpath to allow anything under that directory
baseDir := filepath.Dir(strings.TrimSuffix(expanded, "/**")) baseDir := strings.TrimSuffix(expanded, "/**")
sb.WriteString(fmt.Sprintf("(allow process-exec* (subpath \"%s\"))\n", baseDir)) sb.WriteString(fmt.Sprintf("(allow process-exec* (subpath \"%s\"))\n", baseDir))
} else { } else {
sb.WriteString(fmt.Sprintf("(allow process-exec* (literal \"%s\"))\n", expanded)) sb.WriteString(fmt.Sprintf("(allow process-exec* (literal \"%s\"))\n", expanded))
@@ -196,7 +195,7 @@ func (t *seatbeltPolicyTranslator) translateProcess(policy *sandbox.SandboxPolic
} }
if util.ContainsGlob(expanded) { if util.ContainsGlob(expanded) {
baseDir := filepath.Dir(strings.TrimSuffix(expanded, "/**")) baseDir := strings.TrimSuffix(expanded, "/**")
sb.WriteString(fmt.Sprintf("(deny process-exec* (subpath \"%s\"))\n", baseDir)) sb.WriteString(fmt.Sprintf("(deny process-exec* (subpath \"%s\"))\n", baseDir))
} else { } else {
sb.WriteString(fmt.Sprintf("(deny process-exec* (literal \"%s\"))\n", expanded)) sb.WriteString(fmt.Sprintf("(deny process-exec* (literal \"%s\"))\n", expanded))