mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
3ac83a436d
* feat(sandbox): Seatbelt lockdown translation confines outbound to the PMG proxy Under network_via_proxy_only the Seatbelt profile now denies all network-outbound (with a target=direct violation marker) and allows only the loopback proxy port. SBPL is last-match-wins, so the broad deny is emitted first, specific allows after, and the allow_network_bind rules last — keeping loopback-to-loopback dev traffic working under lockdown. allow_direct_dns re-opens the /var/run/mDNSResponder unix socket that the deny otherwise covers. Replaces the temporary fail-closed rejection in the Seatbelt driver with the real translation; non-lockdown profiles translate byte-identically to before. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS * test(sandbox): assert deny marker presence before ordering comparison Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS * feat(sandbox): render lockdown profiles without a proxy as deny-only with runtime note pmg sandbox profile show renders profiles for debugging and must not fail on lockdown profiles. Without a running proxy the translator keeps the broad deny (rendered profile stays fail-closed, never looser than runtime) and documents the runtime-only proxy-port allow in an SBPL comment instead of fabricating a port. Execution is unaffected: the driver validates the proxy address before translating. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS --------- Co-authored-by: Claude <noreply@anthropic.com>