External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
cursor/linux-system-install
pmg/sandbox/platform/testdata/seatbelt_minimal.sb
T
Abhisek DattaGitHubClaude Fable 5
 e6b5157a2a ci: add macOS test job (#366) 
* ci: add macOS test job

Darwin-tagged tests (Seatbelt translator, diagnostics, upcoming network
lockdown tests) never ran in CI: the test matrix covered ubuntu and
windows only. The M0 sandbox lockdown milestone is macOS-first, so macOS
coverage must exist before enforcement work lands.

Also establishes the convention that darwin integration tests requiring
sandbox-exec must fail (not skip) when running in CI, so missing tooling
cannot silently hide security tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* test(sandbox): make Seatbelt render golden test machine-independent

The golden file baked the authoring machine's HOME, CWD and TMPDIR parent
into the expected profile, so TestRenderSeatbelt_Golden could only pass on
that machine. It never ran in CI before the macOS job exposed it.

Normalize CWD, home and TMPDIR parents (raw and query-escaped forms) to
stable placeholders before comparison, longest path first so prefix
overlaps survive, and rewrite the golden accordingly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* ci: make setup-go cache explicit in macOS job

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-07-10 19:07:15 +05:30

266 lines
20 KiB
Plaintext
Raw Permalink Blame History

(version 1)
;; PMG Sandbox Policy: render-min
;; minimal policy for render golden test
;; Generated by PMG sandbox system
(deny default (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=default|target="))
;; Essential system permissions
;; Based on Chrome/Chromium sandbox for stable process execution
;; Process permissions
(allow process-exec)
(allow process-fork)
(allow process-info* (target same-sandbox))
(allow signal (target same-sandbox))
(allow mach-priv-task-port (target same-sandbox))
;; User preferences
(allow user-preference-read)
;; Mach IPC - specific services only
(allow mach-lookup
(global-name "com.apple.audio.systemsoundserver")
(global-name "com.apple.distributed_notifications@Uv3")
(global-name "com.apple.FSEvents")
(global-name "com.apple.FontObjectsServer")
(global-name "com.apple.fonts")
(global-name "com.apple.logd")
(global-name "com.apple.lsd.mapdb")
(global-name "com.apple.PowerManagement.control")
(global-name "com.apple.system.logger")
(global-name "com.apple.system.notification_center")
(global-name "com.apple.trustd.agent")
(global-name "com.apple.system.opendirectoryd.libinfo")
(global-name "com.apple.system.opendirectoryd.membership")
(global-name "com.apple.bsd.dirhelper")
(global-name "com.apple.securityd.xpc")
(global-name "com.apple.coreservices.launchservicesd")
)
;; POSIX IPC
(allow ipc-posix-shm) ; Shared memory
(allow ipc-posix-sem) ; Semaphores for Python multiprocessing
;; IOKit operations
(allow iokit-open
(iokit-registry-entry-class "IOSurfaceRootUserClient")
(iokit-registry-entry-class "RootDomainUserClient")
(iokit-user-client-class "IOSurfaceSendRight")
)
(allow iokit-get-properties)
;; Specific safe system socket
(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))
;; sysctl - specific sysctls only
(allow sysctl-read
(sysctl-name "hw.activecpu")
(sysctl-name "hw.busfrequency_compat")
(sysctl-name "hw.byteorder")
(sysctl-name "hw.cacheconfig")
(sysctl-name "hw.cachelinesize_compat")
(sysctl-name "hw.cpufamily")
(sysctl-name "hw.cpufrequency")
(sysctl-name "hw.cpufrequency_compat")
(sysctl-name "hw.cputype")
(sysctl-name "hw.l1dcachesize_compat")
(sysctl-name "hw.l1icachesize_compat")
(sysctl-name "hw.l2cachesize_compat")
(sysctl-name "hw.l3cachesize_compat")
(sysctl-name "hw.logicalcpu")
(sysctl-name "hw.logicalcpu_max")
(sysctl-name "hw.machine")
(sysctl-name "hw.memsize")
(sysctl-name "hw.ncpu")
(sysctl-name "hw.nperflevels")
(sysctl-name "hw.packages")
(sysctl-name "hw.pagesize_compat")
(sysctl-name "hw.pagesize")
(sysctl-name "hw.physicalcpu")
(sysctl-name "hw.physicalcpu_max")
(sysctl-name "hw.tbfrequency_compat")
(sysctl-name "hw.vectorunit")
(sysctl-name "kern.argmax")
(sysctl-name "kern.bootargs")
(sysctl-name "kern.hostname")
(sysctl-name "kern.maxfiles")
(sysctl-name "kern.maxfilesperproc")
(sysctl-name "kern.maxproc")
(sysctl-name "kern.ngroups")
(sysctl-name "kern.osproductversion")
(sysctl-name "kern.osrelease")
(sysctl-name "kern.ostype")
(sysctl-name "kern.osvariant_status")
(sysctl-name "kern.osversion")
(sysctl-name "kern.secure_kernel")
(sysctl-name "kern.tcsm_available")
(sysctl-name "kern.tcsm_enable")
(sysctl-name "kern.usrstack64")
(sysctl-name "kern.version")
(sysctl-name "kern.willshutdown")
(sysctl-name "machdep.cpu.brand_string")
(sysctl-name "machdep.ptrauth_enabled")
(sysctl-name "security.mac.lockdown_mode_state")
(sysctl-name "sysctl.proc_cputype")
(sysctl-name "vm.loadavg")
(sysctl-name-prefix "hw.optional.arm")
(sysctl-name-prefix "hw.optional.arm.")
(sysctl-name-prefix "hw.optional.armv8_")
(sysctl-name-prefix "hw.perflevel")
(sysctl-name-prefix "kern.proc.all")
(sysctl-name-prefix "kern.proc.pgrp.")
(sysctl-name-prefix "kern.proc.pid.")
(sysctl-name-prefix "machdep.cpu.")
(sysctl-name-prefix "net.routetable.")
)
;; V8 thread calculations
(allow sysctl-write
(sysctl-name "kern.tcsm_enable")
)
;; Distributed notifications
(allow distributed-notification-post)
;; Specific mach-lookup for security
(allow mach-lookup (global-name "com.apple.SecurityServer"))
;; Device file I/O
(allow file-ioctl (literal "/dev/null"))
(allow file-ioctl (literal "/dev/zero"))
(allow file-ioctl (literal "/dev/random"))
(allow file-ioctl (literal "/dev/urandom"))
(allow file-ioctl (literal "/dev/dtracehelper"))
(allow file-ioctl (literal "/dev/tty"))
(allow file-ioctl file-read-data file-write-data
(require-all
(literal "/dev/null")
(vnode-type CHARACTER-DEVICE)
)
)
;; File metadata for getcwd() and similar
(allow file-read-metadata)
;; System configuration and libraries
(allow file-read* (subpath "/dev"))
(allow file-read* (subpath "/etc"))
;; Filesystem access
(allow file-read* (subpath "/tmp"))
;; Auto-allow TMPDIR parent on macOS
(allow file-write* (subpath "/PMG_GOLDEN_TMPDIR"))
(allow file-write* (subpath "/private/PMG_GOLDEN_TMPDIR"))
(allow file-write* (subpath "/tmp"))
;; Mandatory security denies (credentials, git hooks, etc.)
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.env"))
(deny file-write* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.env"))
(deny file-write* (regex #"^/PMG_GOLDEN_CWD/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.env.%2A"))
(deny file-write* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env.%2A"))
(deny file-write* (regex #"^/PMG_GOLDEN_HOME/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.env.%2A"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.aws"))
(deny file-write* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.aws"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.aws"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.azure"))
(deny file-write* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.azure"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.azure"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.gcloud"))
(deny file-write* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.gcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgcloud"))
(deny file-write* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.kube"))
(deny file-write* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.kube"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.kube"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.ssh"))
(deny file-write* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.ssh"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.ssh"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.gnupg"))
(deny file-write* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gnupg"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.gnupg"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.docker%2Fconfig.json"))
(deny file-write* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.netrc"))
(deny file-write* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.netrc"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.netrc"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git-credentials"))
(deny file-write* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.git-credentials"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git-credentials"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.pgpass"))
(deny file-write* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.pgpass"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.pgpass"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgh"))
(deny file-write* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgh"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgh"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fconfig"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fconfig"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks"))
(deny file-write* (regex #"^/PMG_GOLDEN_CWD/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks%2F%2A%2A"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks"))
(deny file-write* (regex #"^/PMG_GOLDEN_HOME/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.env"))
(deny file-read* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.env"))
(deny file-read* (regex #"^/PMG_GOLDEN_CWD/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.env.%2A"))
(deny file-read* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env.%2A"))
(deny file-read* (regex #"^/PMG_GOLDEN_HOME/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.env.%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.aws"))
(deny file-read* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.aws"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.aws"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.azure"))
(deny file-read* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.azure"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.azure"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.gcloud"))
(deny file-read* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.gcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgcloud"))
(deny file-read* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.kube"))
(deny file-read* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.kube"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.kube"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.ssh"))
(deny file-read* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.ssh"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.ssh"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.gnupg"))
(deny file-read* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gnupg"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.gnupg"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.docker%2Fconfig.json"))
(deny file-read* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.netrc"))
(deny file-read* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.netrc"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.netrc"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git-credentials"))
(deny file-read* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.git-credentials"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git-credentials"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.pgpass"))
(deny file-read* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.pgpass"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.pgpass"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgh"))
(deny file-read* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgh"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgh"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fconfig"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fconfig"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks"))
(deny file-read* (regex #"^/PMG_GOLDEN_CWD/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks"))
(deny file-read* (regex #"^/PMG_GOLDEN_HOME/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks%2F%2A%2A"))
;; Network access
;; Process execution
Reference in New Issue View Git Blame Copy Permalink