External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add Sandbox Inspection and Debugging Commands (#261)

Browse Source 
* feat: add sandbox DX commands

* fix: Linter errors

* fix: Sandbox deny log parsing

* fix: Sandbox docs

* refactor: Maintain SSOT across pkg dependencies

* fix: Linter errors
This commit is contained in:
Abhisek Datta
2026-05-19 14:40:54 +05:30
committed by GitHub
parent 46cc70db53
commit b8588e3df4
97 changed files with 8796 additions and 478 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/platform/testdata/landlock_minimal.txt
Vendored
+110
View File
@@ -0,0 +1,110 @@
# Landlock ruleset
# policy: render-min
abi: GOLDEN (GOLDEN)
features: GOLDEN
allow_pty: false
skip_pid_namespace: false
skip_ipc_namespace: false
filesystem_rules (16):
- path: /tmp
access: execute|read_file|read_dir
- path: /tmp
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
- path: /usr/bin
access: execute|read_file
- path: /usr/sbin
access: execute|read_file
- path: /usr/lib
access: execute|read_file
- path: /usr/lib64
access: execute|read_file
- path: /bin
access: execute|read_file
- path: /sbin
access: execute|read_file
- path: /lib
access: execute|read_file
- path: /lib64
access: execute|read_file
- path: /proc
access: execute|read_file|read_dir
- path: /dev/null
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
- path: /dev/zero
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
- path: /dev/random
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
- path: /dev/urandom
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
- path: /tmp
access: write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
deny_paths (32):
- path: /src/sandbox/platform/.env
mode: both
- path: /root/.env
mode: both
- path: /src/sandbox/platform/.aws
mode: both
- path: /root/.aws
mode: both
- path: /src/sandbox/platform/.azure
mode: both
- path: /root/.azure
mode: both
- path: /src/sandbox/platform/.gcloud
mode: both
- path: /root/.gcloud
mode: both
- path: /src/sandbox/platform/.config/gcloud
mode: both
- path: /root/.config/gcloud
mode: both
- path: /src/sandbox/platform/.kube
mode: both
- path: /root/.kube
mode: both
- path: /src/sandbox/platform/.ssh
mode: both
- path: /root/.ssh
mode: both
- path: /src/sandbox/platform/.gnupg
mode: both
- path: /root/.gnupg
mode: both
- path: /src/sandbox/platform/.docker/config.json
mode: both
- path: /root/.docker/config.json
mode: both
- path: /src/sandbox/platform/.netrc
mode: both
- path: /root/.netrc
mode: both
- path: /src/sandbox/platform/.git-credentials
mode: both
- path: /root/.git-credentials
mode: both
- path: /src/sandbox/platform/.pgpass
mode: both
- path: /root/.pgpass
mode: both
- path: /src/sandbox/platform/.config/gh
mode: both
- path: /root/.config/gh
mode: both
- path: /src/sandbox/platform/.git/config
mode: both
- path: /root/.git/config
mode: both
- path: /src/sandbox/platform/.git/hooks
mode: both
- path: /src/sandbox/platform/.git/hooks
mode: both
- path: /root/.git/hooks
mode: both
- path: /root/.git/hooks
mode: both
deny_exec_paths (1):
- /bin/sh