mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
9693428171
* feat: Sandbox implementation with seatbelt * refactor: Remove concept of PM_CACHE * fix: Misc fixes * refactor: Sandbox for separation of boundaries * fix: Apply API * fix: Add support for sandbox cleanup * test: Add variable interpolation test * fix: Misc cleanup fixes * chore: Cleanup sandbox registry * chore: Cleanup sandbox policy * chore: Cleanup sandbox * fix: Misc cleanup fixes * fix: Remove violation mode * fix: Update config template * chore: Go mod cleanup * fix: Handle the case when package manager policy is explicitly disabled * fix: Sandbox executor * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> * test: Remove unused var * test: Add test for seatbelt sandbox driver * fix: Sandbox profile loader from file should use path for caching * test: Add policy test * feat: Add support for config templates * fix: Seatbelt translator handle glob * fix: Merge conflicts * fix: Fix sandbox policy generator for MacOS min permissions * fix: Sandbox path handling bugs * fix: Deny read to dangerous directories * fix: Deny read to dangerous directories * add sandbox e2e (#112) * fix: Sandbox E2E test * fix: Code review fixes * fix: Code review fixes * doc: Add sandbox debugging guide * doc: Update sandbox doc * docs: Add sandbox usage doc * fix: Use better error for sandbox without policy * fix: Add sandbox for npx * fix: Enable PTY for npm --------- Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
45 lines
1.0 KiB
Markdown
45 lines
1.0 KiB
Markdown
# PMG Sandbox Profiles
|
|
|
|
This directory contains built-in sandbox policies for PMG package managers.
|
|
|
|
## Available Profiles
|
|
|
|
### npm-restrictive
|
|
|
|
Restrictive policy for the npm ecosystem (npm, pnpm, yarn, bun).
|
|
|
|
### pypi-restrictive
|
|
|
|
Restrictive policy for the PyPI ecosystem (pip, pip3, poetry, uv).
|
|
|
|
## Custom Policies
|
|
|
|
You can create custom sandbox policies by:
|
|
|
|
1. Copying one of the built-in profiles
|
|
2. Modifying the rules to suit your needs
|
|
3. Referencing the custom profile in your PMG config:
|
|
|
|
```yaml
|
|
sandbox:
|
|
enabled: true
|
|
policies:
|
|
npm:
|
|
enabled: true
|
|
profile: /path/to/custom-npm-policy.yml
|
|
```
|
|
|
|
## Policy Schema
|
|
|
|
See the [Policy Schema Documentation](../policy.go) for details on the YAML structure.
|
|
|
|
### Supported Variables
|
|
|
|
- `${HOME}`: User home directory
|
|
- `${CWD}`: Current working directory
|
|
- `${TMPDIR}`: Temporary directory
|
|
|
|
## Policy Enforcement
|
|
|
|
All policy violations will block execution. This provides defense-in-depth protection against malicious install scripts and supply chain attacks.
|