mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Claude
d60a558579
Implements process-level environment variable protection per the spec. When the sandbox is enabled, credential-bearing variables are removed from the package manager child process before it is spawned, defending against supply chain attacks that harvest secrets from the environment. - DANGEROUS_ENV_VARS: curated default deny list of known secret names (no generic *_TOKEN/*_SECRET catch-alls); ScrubEnv matcher supports case- insensitive globs so profiles can opt into broader denies. - EnvironmentPolicy (environment.allow / environment.deny) on sandbox profiles, merged under inheritance; deep-copied on resolve. - npm/pypi profiles re-allow their own ecosystem's auth vars so package managers keep working; other ecosystems' and cloud creds stay scrubbed. - New 'env' --sandbox-allow type (and overlay support via the same path): allow-only, value kept verbatim (not path-resolved), governed by lockdown. - Enforced in executor.ApplySandbox as the last step before launch, after overlay and runtime overrides merge; scrubbed names logged for audit. https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW
105 lines
3.1 KiB
YAML
105 lines
3.1 KiB
YAML
name: pypi-restrictive
|
|
description: Restrictive sandbox policy for PyPI ecosystem (pip, poetry, uv)
|
|
package_managers:
|
|
- pip
|
|
- pip3
|
|
- poetry
|
|
- uv
|
|
|
|
# Optional security settings (uncomment to enable)
|
|
# allow_git_config: false # Allow package managers to modify .git/config (default: false, blocks for security)
|
|
|
|
# Allow interactive terminal (PTY) operations (default: false)
|
|
allow_pty: true
|
|
|
|
filesystem:
|
|
allow_read:
|
|
# Root read is required for shims (e.g., asdf, pyenv) that traverse the filesystem.
|
|
# This is safe because deny rules have higher precedence and dangerous files
|
|
# (.env, .ssh, .aws, .gnupg, etc.) are blocked by mandatory deny patterns.
|
|
- /
|
|
- ${CWD}/**
|
|
- ${HOME}/.config/pip/**
|
|
- ${HOME}/.pip/**
|
|
- ${HOME}/.poetry/**
|
|
- ${HOME}/.cache/pip/**
|
|
- ${HOME}/.cache/pypoetry/**
|
|
- ${HOME}/.cache/poetry/**
|
|
- ${HOME}/.cache/uv/**
|
|
- /usr/local/**
|
|
- /Library/**
|
|
- /System/Library/**
|
|
|
|
allow_write:
|
|
# Note: ${TMPDIR} is automatically allowed when write restrictions are enabled (macOS)
|
|
# Note: Patterns ending with /** automatically allow creating the parent directory.
|
|
# For example, ${CWD}/.venv/** allows both:
|
|
# 1. Creating the .venv directory itself
|
|
# 2. Writing any files/directories inside it
|
|
# Temporary directories for shell scripts and package managers
|
|
# Note: On macOS, /tmp is a symlink to /private/tmp, so we need both
|
|
- /tmp/**
|
|
- /private/tmp/**
|
|
- /var/tmp/**
|
|
- ${CWD}/.venv/**
|
|
- ${CWD}/venv/**
|
|
- ${HOME}/.cache/pip/**
|
|
- ${HOME}/.cache/pypoetry/**
|
|
- ${HOME}/.cache/poetry/**
|
|
- ${HOME}/.cache/uv/**
|
|
- ${HOME}/Library/Caches/pip/**
|
|
- ${HOME}/.local/lib/python*/**
|
|
|
|
# Additional deny rules (optional - credentials are automatically blocked)
|
|
# Automatically blocked for security:
|
|
# - .env, .env.*, .ssh/, .aws/, .gcloud/, .kube/, .gnupg/, .docker/config.json
|
|
# - .git/hooks/ (always blocked)
|
|
# - .git/config (blocked unless allow_git_config: true)
|
|
deny_read: []
|
|
|
|
deny_write:
|
|
# Additional system directories to protect
|
|
- /etc/**
|
|
- /usr/**
|
|
|
|
network:
|
|
allow_outbound:
|
|
- pypi.org:443
|
|
- files.pythonhosted.org:443
|
|
- github.com:443
|
|
|
|
deny_outbound:
|
|
- "*:*"
|
|
|
|
environment:
|
|
# Credential-bearing variables are scrubbed by default (see the built-in
|
|
# DANGEROUS_ENV_VARS list). Re-allow only the variables the PyPI ecosystem
|
|
# legitimately needs for index auth, publishing, and TLS.
|
|
#
|
|
# Accepted trade-off: a malicious Python package executed during install can
|
|
# read the PyPI publishing credentials below, but NOT npm tokens, AWS keys, or
|
|
# other cloud/secret-manager credentials, which remain scrubbed.
|
|
allow:
|
|
- TWINE_USERNAME
|
|
- TWINE_PASSWORD
|
|
- TWINE_REPOSITORY*
|
|
- PIP_*
|
|
- UV_*
|
|
- POETRY_*
|
|
|
|
process:
|
|
allow_exec:
|
|
- /usr/bin/python*
|
|
- /usr/local/bin/python*
|
|
- /usr/bin/gcc
|
|
- /usr/bin/clang
|
|
- /usr/bin/git
|
|
# Required for shims (e.g., asdf) that use #!/usr/bin/env bash
|
|
- /bin/bash
|
|
- /bin/sh
|
|
- /usr/bin/env
|
|
|
|
deny_exec:
|
|
- /usr/bin/curl
|
|
- /usr/bin/wget
|