mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
b8588e3df4
* feat: add sandbox DX commands * fix: Linter errors * fix: Sandbox deny log parsing * fix: Sandbox docs * refactor: Maintain SSOT across pkg dependencies * fix: Linter errors
111 lines
3.2 KiB
Plaintext
111 lines
3.2 KiB
Plaintext
# Landlock ruleset
|
|
# policy: render-min
|
|
abi: GOLDEN (GOLDEN)
|
|
features: GOLDEN
|
|
allow_pty: false
|
|
skip_pid_namespace: false
|
|
skip_ipc_namespace: false
|
|
|
|
filesystem_rules (16):
|
|
- path: /tmp
|
|
access: execute|read_file|read_dir
|
|
- path: /tmp
|
|
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
|
|
- path: /usr/bin
|
|
access: execute|read_file
|
|
- path: /usr/sbin
|
|
access: execute|read_file
|
|
- path: /usr/lib
|
|
access: execute|read_file
|
|
- path: /usr/lib64
|
|
access: execute|read_file
|
|
- path: /bin
|
|
access: execute|read_file
|
|
- path: /sbin
|
|
access: execute|read_file
|
|
- path: /lib
|
|
access: execute|read_file
|
|
- path: /lib64
|
|
access: execute|read_file
|
|
- path: /proc
|
|
access: execute|read_file|read_dir
|
|
- path: /dev/null
|
|
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
|
|
- path: /dev/zero
|
|
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
|
|
- path: /dev/random
|
|
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
|
|
- path: /dev/urandom
|
|
access: execute|read_file|read_dir|write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
|
|
- path: /tmp
|
|
access: write_file|truncate|make_reg|make_dir|make_sock|make_fifo|make_block|make_char|make_sym|remove_file|remove_dir|refer
|
|
|
|
deny_paths (32):
|
|
- path: /src/sandbox/platform/.env
|
|
mode: both
|
|
- path: /root/.env
|
|
mode: both
|
|
- path: /src/sandbox/platform/.aws
|
|
mode: both
|
|
- path: /root/.aws
|
|
mode: both
|
|
- path: /src/sandbox/platform/.azure
|
|
mode: both
|
|
- path: /root/.azure
|
|
mode: both
|
|
- path: /src/sandbox/platform/.gcloud
|
|
mode: both
|
|
- path: /root/.gcloud
|
|
mode: both
|
|
- path: /src/sandbox/platform/.config/gcloud
|
|
mode: both
|
|
- path: /root/.config/gcloud
|
|
mode: both
|
|
- path: /src/sandbox/platform/.kube
|
|
mode: both
|
|
- path: /root/.kube
|
|
mode: both
|
|
- path: /src/sandbox/platform/.ssh
|
|
mode: both
|
|
- path: /root/.ssh
|
|
mode: both
|
|
- path: /src/sandbox/platform/.gnupg
|
|
mode: both
|
|
- path: /root/.gnupg
|
|
mode: both
|
|
- path: /src/sandbox/platform/.docker/config.json
|
|
mode: both
|
|
- path: /root/.docker/config.json
|
|
mode: both
|
|
- path: /src/sandbox/platform/.netrc
|
|
mode: both
|
|
- path: /root/.netrc
|
|
mode: both
|
|
- path: /src/sandbox/platform/.git-credentials
|
|
mode: both
|
|
- path: /root/.git-credentials
|
|
mode: both
|
|
- path: /src/sandbox/platform/.pgpass
|
|
mode: both
|
|
- path: /root/.pgpass
|
|
mode: both
|
|
- path: /src/sandbox/platform/.config/gh
|
|
mode: both
|
|
- path: /root/.config/gh
|
|
mode: both
|
|
- path: /src/sandbox/platform/.git/config
|
|
mode: both
|
|
- path: /root/.git/config
|
|
mode: both
|
|
- path: /src/sandbox/platform/.git/hooks
|
|
mode: both
|
|
- path: /src/sandbox/platform/.git/hooks
|
|
mode: both
|
|
- path: /root/.git/hooks
|
|
mode: both
|
|
- path: /root/.git/hooks
|
|
mode: both
|
|
|
|
deny_exec_paths (1):
|
|
- /bin/sh
|