mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
feat(sandbox): scrub sensitive environment variables from package managers
Implements process-level environment variable protection per the spec. When the sandbox is enabled, credential-bearing variables are removed from the package manager child process before it is spawned, defending against supply chain attacks that harvest secrets from the environment. - DANGEROUS_ENV_VARS: curated default deny list of known secret names (no generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case- insensitive globs so profiles can opt into broader denies. - EnvironmentPolicy (environment.allow / environment.deny) on sandbox profiles, merged under inheritance; deep-copied on resolve. - npm/pypi profiles re-allow their own ecosystem's auth vars so package managers keep working; other ecosystems' and cloud creds stay scrubbed. - New 'env' --sandbox-allow type (and overlay support via the same path): allow-only, value kept verbatim (not path-resolved), governed by lockdown. - Enforced in executor.ApplySandbox as the last step before launch, after overlay and runtime overrides merge; scrubbed names logged for audit. https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW
This commit is contained in:
Claude
@@ -24,6 +24,92 @@ var DANGEROUS_FILES = []string{
|
||||
".config/gh",
|
||||
}
|
||||
|
||||
// DANGEROUS_ENV_VARS are credential-bearing environment variables scrubbed from
|
||||
// the child process by default when the sandbox is enabled (see ScrubEnv). This
|
||||
// is an explicit, curated list of known secret names — there are deliberately
|
||||
// no generic "*_TOKEN" / "*_SECRET" catch-alls here, because broad wildcards in
|
||||
// the default would risk clipping legitimate build variables for every user.
|
||||
// The matcher (ScrubEnv) does support glob patterns, so users who want broader
|
||||
// coverage opt into it per profile via environment.deny.
|
||||
//
|
||||
// Matching is case-insensitive (see ScrubEnv). A package manager's own
|
||||
// publishing token is intentionally left scrubbable here and re-allowed per
|
||||
// ecosystem in the profile's environment.allow (e.g. npm re-allows NPM_TOKEN).
|
||||
var DANGEROUS_ENV_VARS = []string{
|
||||
// Cloud providers
|
||||
"AWS_ACCESS_KEY_ID",
|
||||
"AWS_SECRET_ACCESS_KEY",
|
||||
"AWS_SESSION_TOKEN",
|
||||
"AWS_SECURITY_TOKEN",
|
||||
"AZURE_CLIENT_SECRET",
|
||||
"AZURE_CLIENT_ID",
|
||||
"AZURE_TENANT_ID",
|
||||
"ARM_CLIENT_SECRET",
|
||||
"GOOGLE_APPLICATION_CREDENTIALS",
|
||||
"GCP_SERVICE_ACCOUNT_KEY",
|
||||
"CLOUDSDK_AUTH_ACCESS_TOKEN",
|
||||
"DIGITALOCEAN_ACCESS_TOKEN",
|
||||
|
||||
// Package registry / publishing tokens
|
||||
"NPM_TOKEN",
|
||||
"NPM_AUTH_TOKEN",
|
||||
"NODE_AUTH_TOKEN",
|
||||
"NPM_CONFIG__AUTH",
|
||||
"TWINE_USERNAME",
|
||||
"TWINE_PASSWORD",
|
||||
"PYPI_TOKEN",
|
||||
"UV_PUBLISH_TOKEN",
|
||||
"FLIT_PASSWORD",
|
||||
"POETRY_PYPI_TOKEN_PYPI",
|
||||
"POETRY_HTTP_BASIC_PYPI_PASSWORD",
|
||||
"GEM_HOST_API_KEY",
|
||||
"CARGO_REGISTRY_TOKEN",
|
||||
|
||||
// VCS / CI
|
||||
"GITHUB_TOKEN",
|
||||
"GH_TOKEN",
|
||||
"GH_ENTERPRISE_TOKEN",
|
||||
"GITLAB_TOKEN",
|
||||
"CI_JOB_TOKEN",
|
||||
|
||||
// Secrets managers
|
||||
"VAULT_TOKEN",
|
||||
|
||||
// Misc high-value
|
||||
"DOCKER_PASSWORD",
|
||||
"DOCKER_AUTH_CONFIG",
|
||||
"SNYK_TOKEN",
|
||||
"CODECOV_TOKEN",
|
||||
"OPENAI_API_KEY",
|
||||
"ANTHROPIC_API_KEY",
|
||||
"HUGGING_FACE_HUB_TOKEN",
|
||||
}
|
||||
|
||||
// ProtectedEnvVars are core process variables never scrubbed, regardless of
|
||||
// deny patterns. They are matched case-insensitively as globs (see ScrubEnv),
|
||||
// so "LC_*" covers the whole locale family. This is a safety net so that a
|
||||
// profile opting into a broad deny glob (e.g. "*_TOKEN") cannot break process
|
||||
// startup. The built-in DANGEROUS_ENV_VARS list never touches these names.
|
||||
var ProtectedEnvVars = []string{
|
||||
"PATH",
|
||||
"HOME",
|
||||
"USER",
|
||||
"LOGNAME",
|
||||
"SHELL",
|
||||
"PWD",
|
||||
"OLDPWD",
|
||||
"TERM",
|
||||
"TMPDIR",
|
||||
"TEMP",
|
||||
"TMP",
|
||||
"LANG",
|
||||
"LC_*",
|
||||
"TZ",
|
||||
"DISPLAY",
|
||||
"HOSTNAME",
|
||||
"NODE_ENV",
|
||||
}
|
||||
|
||||
// MandatoryDenyOptions configures GetMandatoryDenyPatterns. AllowRead and
|
||||
// AllowWrite must be already expanded (post-ExpandVariables); the function
|
||||
// does not call ExpandVariables itself.
|
||||
|
||||
@@ -0,0 +1,108 @@
|
||||
package util
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"strings"
|
||||
"sync"
|
||||
)
|
||||
|
||||
// EnvScrubOptions configures ScrubEnv. Allow and Deny are variable-name glob
|
||||
// patterns sourced from the resolved sandbox policy's environment section
|
||||
// (already merged with inheritance, project overlay, and --sandbox-allow env=
|
||||
// overrides by the caller). Deny extends the built-in DANGEROUS_ENV_VARS;
|
||||
// Allow suppresses any matching deny (allow wins).
|
||||
type EnvScrubOptions struct {
|
||||
Allow []string
|
||||
Deny []string
|
||||
}
|
||||
|
||||
// EnvScrubResult is the outcome of ScrubEnv. Env holds the kept "KEY=VALUE"
|
||||
// entries; Removed holds the NAMES (never values) of scrubbed variables, for
|
||||
// audit logging.
|
||||
type EnvScrubResult struct {
|
||||
Env []string
|
||||
Removed []string
|
||||
}
|
||||
|
||||
// ScrubEnv removes sensitive variables from env. A variable is removed iff its
|
||||
// name matches the effective deny set (built-in DANGEROUS_ENV_VARS plus
|
||||
// opts.Deny) AND does not match opts.Allow AND is not a ProtectedEnvVars entry.
|
||||
// Matching is on the variable name (left of the first '=') and is
|
||||
// case-insensitive glob (see GlobToRegex). Removal (not blanking) is
|
||||
// intentional: absence is the cleanest "not set" signal for downstream tools.
|
||||
func ScrubEnv(env []string, opts EnvScrubOptions) EnvScrubResult {
|
||||
deny := make([]string, 0, len(DANGEROUS_ENV_VARS)+len(opts.Deny))
|
||||
deny = append(deny, DANGEROUS_ENV_VARS...)
|
||||
deny = append(deny, opts.Deny...)
|
||||
|
||||
kept := make([]string, 0, len(env))
|
||||
var removed []string
|
||||
|
||||
for _, entry := range env {
|
||||
name := entry
|
||||
if i := strings.IndexByte(entry, '='); i >= 0 {
|
||||
name = entry[:i]
|
||||
}
|
||||
|
||||
if shouldScrubEnvVar(name, deny, opts.Allow) {
|
||||
removed = append(removed, name)
|
||||
continue
|
||||
}
|
||||
|
||||
kept = append(kept, entry)
|
||||
}
|
||||
|
||||
return EnvScrubResult{Env: kept, Removed: removed}
|
||||
}
|
||||
|
||||
// shouldScrubEnvVar reports whether a variable named name should be removed.
|
||||
// Protected variables and allow matches are kept; otherwise a deny match
|
||||
// scrubs. Allow wins over deny by construction (checked first).
|
||||
func shouldScrubEnvVar(name string, deny, allow []string) bool {
|
||||
if matchAnyEnvPattern(name, ProtectedEnvVars) {
|
||||
return false
|
||||
}
|
||||
|
||||
if matchAnyEnvPattern(name, allow) {
|
||||
return false
|
||||
}
|
||||
|
||||
return matchAnyEnvPattern(name, deny)
|
||||
}
|
||||
|
||||
func matchAnyEnvPattern(name string, patterns []string) bool {
|
||||
for _, pattern := range patterns {
|
||||
if envNameRegex(pattern).MatchString(name) {
|
||||
return true
|
||||
}
|
||||
}
|
||||
|
||||
return false
|
||||
}
|
||||
|
||||
var (
|
||||
envRegexMu sync.Mutex
|
||||
envRegexCache = map[string]*regexp.Regexp{}
|
||||
)
|
||||
|
||||
// envNameRegex compiles pattern into a case-insensitive anchored regex for
|
||||
// matching environment variable names, caching the result. GlobToRegex escapes
|
||||
// all regex specials, so compilation does not fail in practice; on the
|
||||
// unexpected error we fall back to a literal case-insensitive name match so a
|
||||
// deny pattern is never silently dropped.
|
||||
func envNameRegex(pattern string) *regexp.Regexp {
|
||||
envRegexMu.Lock()
|
||||
defer envRegexMu.Unlock()
|
||||
|
||||
if re, ok := envRegexCache[pattern]; ok {
|
||||
return re
|
||||
}
|
||||
|
||||
re, err := regexp.Compile("(?i)" + GlobToRegex(pattern))
|
||||
if err != nil {
|
||||
re = regexp.MustCompile("(?i)^" + regexp.QuoteMeta(pattern) + "$")
|
||||
}
|
||||
|
||||
envRegexCache[pattern] = re
|
||||
return re
|
||||
}
|
||||
@@ -0,0 +1,96 @@
|
||||
package util
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestScrubEnv(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
env []string
|
||||
opts EnvScrubOptions
|
||||
wantKept []string
|
||||
wantRemoved []string
|
||||
}{
|
||||
{
|
||||
name: "built-in deny scrubs known secret",
|
||||
env: []string{"PATH=/usr/bin", "AWS_SECRET_ACCESS_KEY=abc"},
|
||||
wantKept: []string{"PATH=/usr/bin"},
|
||||
wantRemoved: []string{"AWS_SECRET_ACCESS_KEY"},
|
||||
},
|
||||
{
|
||||
name: "case-insensitive match",
|
||||
env: []string{"aws_secret_access_key=abc"},
|
||||
wantKept: []string{},
|
||||
wantRemoved: []string{"aws_secret_access_key"},
|
||||
},
|
||||
{
|
||||
name: "allow suppresses built-in deny",
|
||||
env: []string{"NPM_TOKEN=secret"},
|
||||
opts: EnvScrubOptions{Allow: []string{"NPM_TOKEN"}},
|
||||
wantKept: []string{"NPM_TOKEN=secret"},
|
||||
wantRemoved: nil,
|
||||
},
|
||||
{
|
||||
name: "profile deny glob scrubs",
|
||||
env: []string{"MY_CUSTOM_TOKEN=x", "OTHER=y"},
|
||||
opts: EnvScrubOptions{Deny: []string{"*_TOKEN"}},
|
||||
wantKept: []string{"OTHER=y"},
|
||||
wantRemoved: []string{"MY_CUSTOM_TOKEN"},
|
||||
},
|
||||
{
|
||||
name: "allow glob wins over profile deny glob",
|
||||
env: []string{"npm_config_registry=x", "npm_config_token=y"},
|
||||
opts: EnvScrubOptions{Deny: []string{"*_TOKEN", "npm_config_*"}, Allow: []string{"npm_config_*"}},
|
||||
wantKept: []string{"npm_config_registry=x", "npm_config_token=y"},
|
||||
wantRemoved: nil,
|
||||
},
|
||||
{
|
||||
name: "protected essential never scrubbed even under broad deny",
|
||||
env: []string{"PATH=/usr/bin", "HOME=/home/u", "LC_ALL=en_US.UTF-8"},
|
||||
opts: EnvScrubOptions{Deny: []string{"*"}},
|
||||
wantKept: []string{"PATH=/usr/bin", "HOME=/home/u", "LC_ALL=en_US.UTF-8"},
|
||||
wantRemoved: nil,
|
||||
},
|
||||
{
|
||||
name: "non-sensitive variables are kept",
|
||||
env: []string{"FOO=bar", "EDITOR=vim"},
|
||||
wantKept: []string{"FOO=bar", "EDITOR=vim"},
|
||||
wantRemoved: nil,
|
||||
},
|
||||
{
|
||||
name: "entry without equals is treated as a name",
|
||||
env: []string{"GITHUB_TOKEN", "PLAINNAME"},
|
||||
wantKept: []string{"PLAINNAME"},
|
||||
wantRemoved: []string{"GITHUB_TOKEN"},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got := ScrubEnv(tt.env, tt.opts)
|
||||
assert.Equal(t, tt.wantKept, got.Env)
|
||||
assert.Equal(t, tt.wantRemoved, got.Removed)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestScrubEnv_RemovesEntirelyNotBlanked(t *testing.T) {
|
||||
got := ScrubEnv([]string{"GITHUB_TOKEN=secret"}, EnvScrubOptions{})
|
||||
|
||||
require.Empty(t, got.Env)
|
||||
assert.NotContains(t, got.Env, "GITHUB_TOKEN=")
|
||||
assert.Equal(t, []string{"GITHUB_TOKEN"}, got.Removed)
|
||||
}
|
||||
|
||||
func TestScrubEnv_NoCatchAllsInBuiltinList(t *testing.T) {
|
||||
// A novel token name must NOT be scrubbed by the default list (catch-alls
|
||||
// are opt-in per profile, never built in).
|
||||
got := ScrubEnv([]string{"SOME_RANDOM_TOKEN=x"}, EnvScrubOptions{})
|
||||
|
||||
assert.Equal(t, []string{"SOME_RANDOM_TOKEN=x"}, got.Env)
|
||||
assert.Empty(t, got.Removed)
|
||||
}
|
||||
Reference in New Issue
Block a user