External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci: add macOS test job (#366)

Browse Source 
* ci: add macOS test job

Darwin-tagged tests (Seatbelt translator, diagnostics, upcoming network
lockdown tests) never ran in CI: the test matrix covered ubuntu and
windows only. The M0 sandbox lockdown milestone is macOS-first, so macOS
coverage must exist before enforcement work lands.

Also establishes the convention that darwin integration tests requiring
sandbox-exec must fail (not skip) when running in CI, so missing tooling
cannot silently hide security tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* test(sandbox): make Seatbelt render golden test machine-independent

The golden file baked the authoring machine's HOME, CWD and TMPDIR parent
into the expected profile, so TestRenderSeatbelt_Golden could only pass on
that machine. It never ran in CI before the macOS job exposed it.

Normalize CWD, home and TMPDIR parents (raw and query-escaped forms) to
stable placeholders before comparison, longest path first so prefix
overlaps survive, and rewrite the golden accordingly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* ci: make setup-go cache explicit in macOS job

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

---------

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Abhisek Datta
2026-07-10 19:07:15 +05:30
committed by GitHub
co-authored by Claude Fable 5
parent 31e51b10dd
commit e6b5157a2a
3 changed files with 138 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+24
View File
@@ -40,6 +40,30 @@ jobs:
with:
token: ${{ secrets.CODECOV_TOKEN }}
# Runs the darwin-tagged tests (sandbox/platform/*_darwin_test.go) that no
# other job can execute. Convention for darwin integration tests requiring
# sandbox-exec: fail instead of skip when running in CI
# (os.Getenv("CI") != "" => t.Fatal) so missing tooling cannot silently
# hide security tests.
test-macos:
timeout-minutes: 15
runs-on: macos-latest
steps:
- name: Checkout Source
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
with:
go-version-file: go.mod
cache: true
- name: Build and Test
run: |
go mod tidy
go build
go test -count=1 -v ./...
test-windows:
timeout-minutes: 15
runs-on: windows-latest
sandbox/platform/seatbelt_render_darwin_test.go
+44 -3
View File
@@ -4,13 +4,18 @@
package platform
import (
"bytes"
"net/url"
"os"
"path/filepath"
"regexp"
"sort"
"strings"
"testing"
"github.com/safedep/dry/utils"
"github.com/safedep/pmg/sandbox"
"github.com/safedep/pmg/sandbox/util"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
@@ -19,8 +24,44 @@ import (
// comparisons are deterministic across runs.
var seatbeltLogTagPattern = regexp.MustCompile(`PMG_SBX_[A-Za-z0-9]+`)
func normalizeSeatbeltOutput(b []byte) []byte {
return seatbeltLogTagPattern.ReplaceAll(b, []byte("PMG_SBX_GOLDENXXXXXX"))
// normalizeSeatbeltOutput makes renders comparable across machines: the
// random log tag, the CWD and home directory anchoring the dangerous-path
// rules (both raw and query-escaped in violation markers), and the TMPDIR
// parents are replaced with stable placeholders. Longer paths are replaced
// first so prefix overlaps (CWD under home, /private variants) stay intact.
func normalizeSeatbeltOutput(t *testing.T, b []byte) []byte {
t.Helper()
out := seatbeltLogTagPattern.ReplaceAll(b, []byte("PMG_SBX_GOLDENXXXXXX"))
cwd, err := os.Getwd()
require.NoError(t, err)
home, err := os.UserHomeDir()
require.NoError(t, err)
subs := []struct{ real, placeholder string }{
{cwd, "/PMG_GOLDEN_CWD"},
{home, "/PMG_GOLDEN_HOME"},
}
for _, parent := range util.GetTmpdirParent() {
placeholder := "/PMG_GOLDEN_TMPDIR"
if strings.HasPrefix(parent, "/private/") {
placeholder = "/private/PMG_GOLDEN_TMPDIR"
}
subs = append(subs, struct{ real, placeholder string }{parent, placeholder})
}
sort.SliceStable(subs, func(i, j int) bool {
return len(subs[i].real) > len(subs[j].real)
})
for _, sub := range subs {
out = bytes.ReplaceAll(out, []byte(sub.real), []byte(sub.placeholder))
out = bytes.ReplaceAll(out,
[]byte(url.QueryEscape(sub.real)),
[]byte(url.QueryEscape(sub.placeholder)))
}
return out
}
func TestRenderSeatbelt_Golden(t *testing.T) {
@@ -51,7 +92,7 @@ func TestRenderSeatbelt_Golden(t *testing.T) {
require.NoError(t, err)
goldenPath := filepath.Join("testdata", tc.goldenFile)
normalized := normalizeSeatbeltOutput(got)
normalized := normalizeSeatbeltOutput(t, got)
if os.Getenv("UPDATE_GOLDEN") != "" {
require.NoError(t, os.WriteFile(goldenPath, normalized, 0o644))
sandbox/platform/testdata/seatbelt_minimal.sb
Vendored
+70 -70
View File
@@ -152,110 +152,110 @@
(allow file-read* (subpath "/tmp"))
;; Auto-allow TMPDIR parent on macOS
(allow file-write* (subpath "/var/folders/8k/n1r5cyfs0gd5044p35ymlg780000gn"))
(allow file-write* (subpath "/private/var/folders/8k/n1r5cyfs0gd5044p35ymlg780000gn"))
(allow file-write* (subpath "/PMG_GOLDEN_TMPDIR"))
(allow file-write* (subpath "/private/PMG_GOLDEN_TMPDIR"))
(allow file-write* (subpath "/tmp"))
;; Mandatory security denies (credentials, git hooks, etc.)
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.env"))
(deny file-write* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env"))
(deny file-write* (subpath "/Users/dev/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.env"))
(deny file-write* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env.%2A"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.env"))
(deny file-write* (regex #"^/PMG_GOLDEN_CWD/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.env.%2A"))
(deny file-write* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env.%2A"))
(deny file-write* (regex #"^/Users/dev/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.env.%2A"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.aws"))
(deny file-write* (regex #"^/PMG_GOLDEN_HOME/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.env.%2A"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.aws"))
(deny file-write* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.aws"))
(deny file-write* (subpath "/Users/dev/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.aws"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.azure"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.aws"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.azure"))
(deny file-write* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.azure"))
(deny file-write* (subpath "/Users/dev/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.azure"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.azure"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.gcloud"))
(deny file-write* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gcloud"))
(deny file-write* (subpath "/Users/dev/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.gcloud"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.gcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgcloud"))
(deny file-write* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-write* (subpath "/Users/dev/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.config%2Fgcloud"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.kube"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.kube"))
(deny file-write* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.kube"))
(deny file-write* (subpath "/Users/dev/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.kube"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.ssh"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.kube"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.ssh"))
(deny file-write* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.ssh"))
(deny file-write* (subpath "/Users/dev/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.ssh"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gnupg"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.ssh"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.gnupg"))
(deny file-write* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gnupg"))
(deny file-write* (subpath "/Users/dev/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.gnupg"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.gnupg"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.docker%2Fconfig.json"))
(deny file-write* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/Users/dev/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.netrc"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.netrc"))
(deny file-write* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.netrc"))
(deny file-write* (subpath "/Users/dev/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.netrc"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git-credentials"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.netrc"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git-credentials"))
(deny file-write* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.git-credentials"))
(deny file-write* (subpath "/Users/dev/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git-credentials"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.pgpass"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git-credentials"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.pgpass"))
(deny file-write* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.pgpass"))
(deny file-write* (subpath "/Users/dev/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.pgpass"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgh"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.pgpass"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgh"))
(deny file-write* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgh"))
(deny file-write* (subpath "/Users/dev/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.config%2Fgh"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fconfig"))
(deny file-write* (subpath "/Users/dev/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git%2Fconfig"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks"))
(deny file-write* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks%2F%2A%2A"))
(deny file-write* (subpath "/Users/dev/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git%2Fhooks"))
(deny file-write* (regex #"^/Users/dev/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgh"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fconfig"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fconfig"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks"))
(deny file-write* (regex #"^/PMG_GOLDEN_CWD/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks%2F%2A%2A"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks"))
(deny file-write* (regex #"^/PMG_GOLDEN_HOME/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.env"))
(deny file-read* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env"))
(deny file-read* (subpath "/Users/dev/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.env"))
(deny file-read* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env.%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.env"))
(deny file-read* (regex #"^/PMG_GOLDEN_CWD/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.env.%2A"))
(deny file-read* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env.%2A"))
(deny file-read* (regex #"^/Users/dev/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.env.%2A"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.aws"))
(deny file-read* (regex #"^/PMG_GOLDEN_HOME/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.env.%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.aws"))
(deny file-read* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.aws"))
(deny file-read* (subpath "/Users/dev/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.aws"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.azure"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.aws"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.azure"))
(deny file-read* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.azure"))
(deny file-read* (subpath "/Users/dev/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.azure"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.azure"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.gcloud"))
(deny file-read* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gcloud"))
(deny file-read* (subpath "/Users/dev/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.gcloud"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.gcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgcloud"))
(deny file-read* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-read* (subpath "/Users/dev/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.config%2Fgcloud"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.kube"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.kube"))
(deny file-read* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.kube"))
(deny file-read* (subpath "/Users/dev/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.kube"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.ssh"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.kube"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.ssh"))
(deny file-read* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.ssh"))
(deny file-read* (subpath "/Users/dev/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.ssh"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gnupg"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.ssh"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.gnupg"))
(deny file-read* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gnupg"))
(deny file-read* (subpath "/Users/dev/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.gnupg"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.gnupg"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.docker%2Fconfig.json"))
(deny file-read* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/Users/dev/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.netrc"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.netrc"))
(deny file-read* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.netrc"))
(deny file-read* (subpath "/Users/dev/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.netrc"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git-credentials"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.netrc"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git-credentials"))
(deny file-read* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.git-credentials"))
(deny file-read* (subpath "/Users/dev/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git-credentials"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.pgpass"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git-credentials"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.pgpass"))
(deny file-read* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.pgpass"))
(deny file-read* (subpath "/Users/dev/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.pgpass"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgh"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.pgpass"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgh"))
(deny file-read* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgh"))
(deny file-read* (subpath "/Users/dev/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.config%2Fgh"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fconfig"))
(deny file-read* (subpath "/Users/dev/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git%2Fconfig"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks"))
(deny file-read* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/Users/dev/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git%2Fhooks"))
(deny file-read* (regex #"^/Users/dev/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgh"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fconfig"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fconfig"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks"))
(deny file-read* (regex #"^/PMG_GOLDEN_CWD/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks"))
(deny file-read* (regex #"^/PMG_GOLDEN_HOME/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks%2F%2A%2A"))
;; Network access