mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
* feat(sandbox): introduce presets - additive workload allowance bundles Presets are named, additive-only bundles of sandbox allowances for a specific workload (git hooks tooling, Astro/Vite/Next.js dev servers). They solve the per-workload tuning friction from #384 without weakening the default posture: no built-in profile references a preset, presets cannot carry deny rules or profile booleans (strict YAML decoding), and mandatory denies still win everywhere except the existing exact-match suppression. - Preset schema with metadata (author, labels) and schema_version gating - Registry over ordered sources (embedded builtin, user dir); builtin wins name collisions; source abstraction is the extension point for a future hosted registry and SafeDep cloud sync - Official presets: git, astro, vite, nextjs (with threat notes) - Overlay/runtime integration: pmg sandbox allow preset=<name> and --sandbox-allow preset=<name>, stored by reference, resolved at apply time, missing presets warn (fail closed) instead of aborting - Profile integration: presets: [...] list resolved after inherits - CLI: pmg sandbox preset list (metadata filters, --json), show (prints YAML with threat notes), lint - Docs: user guide (docs/sandbox-presets.md) and design spec Closes #384 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): address review findings on presets - Presets never modify deny lists: a profile authored deny now survives a preset allowing the same path (deny-beats-allow keeps it enforced). Regression test added. - Profile inspection commands (show, diff, lint) construct the profile registry with the user-aware preset registry so they agree with runtime resolution of custom profiles referencing user presets. - Handle stderr write error when warning about unresolvable presets. - Compute preset show underline from the uncolored header. - Use path.Join for embed.FS reads (slash-separated on all platforms). - Clarify in docs that lint-staged/astro are examples of preset workloads. - Drop the design spec from the PR per review. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): harden preset precedence against authored denies Addresses external security review findings on the preset mechanism: - Bubblewrap: a mandatory write-denied path listed in allow_read lost its protection when a later writable parent bind covered it (bwrap last mount wins) - exactly the git preset shape (allow_read .git/config + allow_write .git/**). The mandatory deny now re-binds the path read-only after all writable mounts instead of being skipped. Regression test asserts mount ordering. Landlock and Seatbelt were unaffected (tests added for the same policy shape on Landlock). - Environment: ScrubEnv is allow-wins, so a preset environment allowance could override a profile-authored deny. Preset env allowances overlapping an authored deny pattern are now dropped at application time (conservative bidirectional glob overlap, fail closed). Surviving entries still opt out of built-in credential scrubbing as intended. - Network: removed allow_outbound from the preset schema. Both platform translators are all-or-nothing for outbound (one allow rule means blanket network access), so a preset outbound entry would silently change network posture far beyond what its YAML conveys. Strict decoding rejects the key. - Added a dual-path expansion equivalence test (profile presets: field vs overlay/--sandbox-allow) and documented the precedence guarantees in docs/sandbox-presets.md. Explicit --sandbox-allow and pmg sandbox allow overrides keep their existing semantics. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * docs(sandbox): document env and preset allowances in allow command and overlay docs pmg sandbox allow help, the --sandbox-allow flag usage, and the project overlay docs enumerated only read/write/exec/net types. Add env and preset to all of them, with an overlay example for persisting an env allowance and a note on why env entries are not auto-promoted by --last. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * chore(sandbox): trim preset code comments to corner cases and minimal godocs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): exact glob intersection for preset env deny overlap The bidirectional literal-text heuristic missed overlapping globs with different literal structure: preset allow AWS_*_KEY and authored deny AWS_SECRET_* both match AWS_SECRET_ACCESS_KEY but neither pattern matches the other's text, so the allowance merged and allow-wins scrubbing exposed the variable. EnvPatternsOverlap now computes exact intersection non-emptiness for the name glob dialect (case-insensitive, '*' any sequence, '?' single char) via memoized DP. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): preset env allowances are exact names, not globs Glob-vs-glob intersection is a losing game: every dialect extension (character classes today) silently reopens the deny-bypass hole. Restricting preset environment allowances to literal variable names makes the authored-deny precedence check exact by construction: each deny pattern is evaluated against the concrete name with the same matcher ScrubEnv uses at runtime, so the decision cannot diverge from enforcement regardless of deny dialect. Removes the glob intersection machinery. Profile and --sandbox-allow env globs are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * fix(sandbox): reject mandatory-deny targets in preset paths Preset validation relied on IsSensitiveProjectTarget, which covers fewer files than util.DANGEROUS_FILES. A preset naming .git-credentials, .pgpass, .docker/config.json or .config/gh exactly would exact-match suppress the mandatory deny; .git/config in allow_write would suppress the write protection. Preset paths are now checked against DANGEROUS_FILES (single source of truth), .git/hooks is rejected in any direction, and .git/config is rejected for write/exec while read stays allowed for git repo discovery. Docs state the two deliberate opt-outs precisely. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * feat(sandbox): preset init and edit commands for community authoring pmg sandbox preset init scaffolds a valid user preset (metadata flags, threat-note template, starter rule) and refuses built-in names since builtins win resolution. pmg sandbox preset edit opens the file via the shared editor package and validates the result, warning when a user preset is shadowed by a built-in. Docs lead with the scaffolded flow and spell out builtin-vs-community provenance in preset list. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn * refactor(sandbox): move mandatory-target matching into util Preset path validation re-encoded knowledge util already owns: the dangerous-files comparison and hardcoded .git/config and .git/hooks strings. util now exports GitConfigPath, GitHooksPath (also used by GetMandatoryDenyPatterns), PathCoveredBy and DangerousFileMatch, and preset validation consumes them so the mandatory deny policy has a single definition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PETCfE4crLcmodosz12qRn --------- Co-authored-by: Claude <noreply@anthropic.com>
154 lines
4.1 KiB
Go
154 lines
4.1 KiB
Go
package sandbox
|
|
|
|
import (
|
|
"fmt"
|
|
"io"
|
|
"strings"
|
|
|
|
"github.com/safedep/pmg/internal/ui"
|
|
pmgsandbox "github.com/safedep/pmg/sandbox"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
type presetListOptions struct {
|
|
jsonOut bool
|
|
author string
|
|
labels []string
|
|
}
|
|
|
|
func newPresetListCommand(factory presetRegistryFactory) *cobra.Command {
|
|
opts := &presetListOptions{}
|
|
|
|
cmd := &cobra.Command{
|
|
Use: "list",
|
|
Short: "List available sandbox presets (built-in and user)",
|
|
Example: " pmg sandbox preset list\n pmg sandbox preset list --label dev-server --author SafeDep",
|
|
SilenceErrors: false,
|
|
Args: cobra.NoArgs,
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
if err := runPresetList(cmd.OutOrStdout(), opts, factory); err != nil {
|
|
return sandboxErrorExit(cmd, err)
|
|
}
|
|
return nil
|
|
},
|
|
}
|
|
|
|
cmd.Flags().BoolVar(&opts.jsonOut, "json", false, "Emit presets as JSON")
|
|
cmd.Flags().StringVar(&opts.author, "author", "", "Only presets by this author (case-insensitive)")
|
|
cmd.Flags().StringArrayVar(&opts.labels, "label", nil, "Only presets carrying this label (repeatable, all must match)")
|
|
return cmd
|
|
}
|
|
|
|
func runPresetList(out io.Writer, opts *presetListOptions, factory presetRegistryFactory) error {
|
|
registry, err := factory()
|
|
if err != nil {
|
|
return presetRegistryError(err)
|
|
}
|
|
|
|
infos, err := registry.List()
|
|
if err != nil {
|
|
return presetRegistryError(err)
|
|
}
|
|
|
|
infos = pmgsandbox.FilterPresets(infos, pmgsandbox.PresetFilter{
|
|
Author: opts.author,
|
|
Labels: opts.labels,
|
|
})
|
|
|
|
if opts.jsonOut {
|
|
return writePresetListJSON(out, infos)
|
|
}
|
|
|
|
return renderPresetListHuman(out, infos)
|
|
}
|
|
|
|
type jsonPresetSummary struct {
|
|
Name string `json:"name"`
|
|
Source string `json:"source"`
|
|
Path string `json:"path,omitempty"`
|
|
Author string `json:"author,omitempty"`
|
|
Labels []string `json:"labels,omitempty"`
|
|
Description string `json:"description,omitempty"`
|
|
Shadowed bool `json:"shadowed,omitempty"`
|
|
}
|
|
|
|
type jsonPresetListReport struct {
|
|
Presets []jsonPresetSummary `json:"presets"`
|
|
}
|
|
|
|
func writePresetListJSON(out io.Writer, infos []pmgsandbox.PresetInfo) error {
|
|
report := jsonPresetListReport{Presets: make([]jsonPresetSummary, 0, len(infos))}
|
|
for _, info := range infos {
|
|
report.Presets = append(report.Presets, jsonPresetSummary{
|
|
Name: info.Preset.Name,
|
|
Source: string(info.Source),
|
|
Path: info.Path,
|
|
Author: info.Preset.Metadata.Author,
|
|
Labels: info.Preset.Metadata.Labels,
|
|
Description: info.Preset.Description,
|
|
Shadowed: info.Shadowed,
|
|
})
|
|
}
|
|
|
|
return writeJSONIndent(out, report)
|
|
}
|
|
|
|
func renderPresetListHuman(out io.Writer, infos []pmgsandbox.PresetInfo) error {
|
|
if len(infos) == 0 {
|
|
_, err := fmt.Fprintln(out, ui.Colors.Dim("No sandbox presets match."))
|
|
return err
|
|
}
|
|
|
|
if _, err := fmt.Fprintln(out); err != nil {
|
|
return err
|
|
}
|
|
if _, err := fmt.Fprintln(out, ui.Colors.Cyan("Sandbox Presets")); err != nil {
|
|
return err
|
|
}
|
|
if _, err := fmt.Fprintln(out, ui.Colors.Normal("----------------")); err != nil {
|
|
return err
|
|
}
|
|
|
|
rows := make([][]string, 0, len(infos)+1)
|
|
rows = append(rows, []string{
|
|
ui.Colors.Bold("STATUS"),
|
|
ui.Colors.Bold("NAME"),
|
|
ui.Colors.Bold("SOURCE"),
|
|
ui.Colors.Bold("AUTHOR"),
|
|
ui.Colors.Bold("LABELS"),
|
|
ui.Colors.Bold("DESCRIPTION"),
|
|
})
|
|
for _, info := range infos {
|
|
rows = append(rows, []string{
|
|
presetStatusCell(info),
|
|
info.Preset.Name,
|
|
presetSourceCell(info),
|
|
emptyDash(info.Preset.Metadata.Author),
|
|
truncate(strings.Join(info.Preset.Metadata.Labels, ","), 30),
|
|
truncate(info.Preset.Description, 60),
|
|
})
|
|
}
|
|
|
|
if err := renderTable(out, rows, nil); err != nil {
|
|
return err
|
|
}
|
|
|
|
_, err := fmt.Fprintf(out, "\n%s\n",
|
|
ui.Colors.Dim("Apply to this repo: pmg sandbox allow preset=<name>"))
|
|
return err
|
|
}
|
|
|
|
func presetStatusCell(info pmgsandbox.PresetInfo) string {
|
|
if info.Shadowed {
|
|
return ui.Colors.Dim("SHADOWED")
|
|
}
|
|
return " "
|
|
}
|
|
|
|
func presetSourceCell(info pmgsandbox.PresetInfo) string {
|
|
if info.Source == pmgsandbox.PresetSourceBuiltin {
|
|
return ui.Colors.Dim("builtin")
|
|
}
|
|
return truncateLeft(info.Path, 50)
|
|
}
|