External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
b8588e3df40b86b491539e746aa85297c544e3be
pmg/sandbox/platform/testdata/seatbelt_minimal.sb
T
Abhisek DattaandGitHub b8588e3df4 feat: Add Sandbox Inspection and Debugging Commands (#261) 
* feat: add sandbox DX commands

* fix: Linter errors

* fix: Sandbox deny log parsing

* fix: Sandbox docs

* refactor: Maintain SSOT across pkg dependencies

* fix: Linter errors
2026-05-19 14:40:54 +05:30

266 lines
22 KiB
Plaintext
Raw Blame History

(version 1)
;; PMG Sandbox Policy: render-min
;; minimal policy for render golden test
;; Generated by PMG sandbox system
(deny default (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=default|target="))
;; Essential system permissions
;; Based on Chrome/Chromium sandbox for stable process execution
;; Process permissions
(allow process-exec)
(allow process-fork)
(allow process-info* (target same-sandbox))
(allow signal (target same-sandbox))
(allow mach-priv-task-port (target same-sandbox))
;; User preferences
(allow user-preference-read)
;; Mach IPC - specific services only
(allow mach-lookup
(global-name "com.apple.audio.systemsoundserver")
(global-name "com.apple.distributed_notifications@Uv3")
(global-name "com.apple.FSEvents")
(global-name "com.apple.FontObjectsServer")
(global-name "com.apple.fonts")
(global-name "com.apple.logd")
(global-name "com.apple.lsd.mapdb")
(global-name "com.apple.PowerManagement.control")
(global-name "com.apple.system.logger")
(global-name "com.apple.system.notification_center")
(global-name "com.apple.trustd.agent")
(global-name "com.apple.system.opendirectoryd.libinfo")
(global-name "com.apple.system.opendirectoryd.membership")
(global-name "com.apple.bsd.dirhelper")
(global-name "com.apple.securityd.xpc")
(global-name "com.apple.coreservices.launchservicesd")
)
;; POSIX IPC
(allow ipc-posix-shm) ; Shared memory
(allow ipc-posix-sem) ; Semaphores for Python multiprocessing
;; IOKit operations
(allow iokit-open
(iokit-registry-entry-class "IOSurfaceRootUserClient")
(iokit-registry-entry-class "RootDomainUserClient")
(iokit-user-client-class "IOSurfaceSendRight")
)
(allow iokit-get-properties)
;; Specific safe system socket
(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))
;; sysctl - specific sysctls only
(allow sysctl-read
(sysctl-name "hw.activecpu")
(sysctl-name "hw.busfrequency_compat")
(sysctl-name "hw.byteorder")
(sysctl-name "hw.cacheconfig")
(sysctl-name "hw.cachelinesize_compat")
(sysctl-name "hw.cpufamily")
(sysctl-name "hw.cpufrequency")
(sysctl-name "hw.cpufrequency_compat")
(sysctl-name "hw.cputype")
(sysctl-name "hw.l1dcachesize_compat")
(sysctl-name "hw.l1icachesize_compat")
(sysctl-name "hw.l2cachesize_compat")
(sysctl-name "hw.l3cachesize_compat")
(sysctl-name "hw.logicalcpu")
(sysctl-name "hw.logicalcpu_max")
(sysctl-name "hw.machine")
(sysctl-name "hw.memsize")
(sysctl-name "hw.ncpu")
(sysctl-name "hw.nperflevels")
(sysctl-name "hw.packages")
(sysctl-name "hw.pagesize_compat")
(sysctl-name "hw.pagesize")
(sysctl-name "hw.physicalcpu")
(sysctl-name "hw.physicalcpu_max")
(sysctl-name "hw.tbfrequency_compat")
(sysctl-name "hw.vectorunit")
(sysctl-name "kern.argmax")
(sysctl-name "kern.bootargs")
(sysctl-name "kern.hostname")
(sysctl-name "kern.maxfiles")
(sysctl-name "kern.maxfilesperproc")
(sysctl-name "kern.maxproc")
(sysctl-name "kern.ngroups")
(sysctl-name "kern.osproductversion")
(sysctl-name "kern.osrelease")
(sysctl-name "kern.ostype")
(sysctl-name "kern.osvariant_status")
(sysctl-name "kern.osversion")
(sysctl-name "kern.secure_kernel")
(sysctl-name "kern.tcsm_available")
(sysctl-name "kern.tcsm_enable")
(sysctl-name "kern.usrstack64")
(sysctl-name "kern.version")
(sysctl-name "kern.willshutdown")
(sysctl-name "machdep.cpu.brand_string")
(sysctl-name "machdep.ptrauth_enabled")
(sysctl-name "security.mac.lockdown_mode_state")
(sysctl-name "sysctl.proc_cputype")
(sysctl-name "vm.loadavg")
(sysctl-name-prefix "hw.optional.arm")
(sysctl-name-prefix "hw.optional.arm.")
(sysctl-name-prefix "hw.optional.armv8_")
(sysctl-name-prefix "hw.perflevel")
(sysctl-name-prefix "kern.proc.all")
(sysctl-name-prefix "kern.proc.pgrp.")
(sysctl-name-prefix "kern.proc.pid.")
(sysctl-name-prefix "machdep.cpu.")
(sysctl-name-prefix "net.routetable.")
)
;; V8 thread calculations
(allow sysctl-write
(sysctl-name "kern.tcsm_enable")
)
;; Distributed notifications
(allow distributed-notification-post)
;; Specific mach-lookup for security
(allow mach-lookup (global-name "com.apple.SecurityServer"))
;; Device file I/O
(allow file-ioctl (literal "/dev/null"))
(allow file-ioctl (literal "/dev/zero"))
(allow file-ioctl (literal "/dev/random"))
(allow file-ioctl (literal "/dev/urandom"))
(allow file-ioctl (literal "/dev/dtracehelper"))
(allow file-ioctl (literal "/dev/tty"))
(allow file-ioctl file-read-data file-write-data
(require-all
(literal "/dev/null")
(vnode-type CHARACTER-DEVICE)
)
)
;; File metadata for getcwd() and similar
(allow file-read-metadata)
;; System configuration and libraries
(allow file-read* (subpath "/dev"))
(allow file-read* (subpath "/etc"))
;; Filesystem access
(allow file-read* (subpath "/tmp"))
;; Auto-allow TMPDIR parent on macOS
(allow file-write* (subpath "/var/folders/8k/n1r5cyfs0gd5044p35ymlg780000gn"))
(allow file-write* (subpath "/private/var/folders/8k/n1r5cyfs0gd5044p35ymlg780000gn"))
(allow file-write* (subpath "/tmp"))
;; Mandatory security denies (credentials, git hooks, etc.)
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env"))
(deny file-write* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env"))
(deny file-write* (subpath "/Users/dev/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.env"))
(deny file-write* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env.%2A"))
(deny file-write* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env.%2A"))
(deny file-write* (regex #"^/Users/dev/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.env.%2A"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.aws"))
(deny file-write* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.aws"))
(deny file-write* (subpath "/Users/dev/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.aws"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.azure"))
(deny file-write* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.azure"))
(deny file-write* (subpath "/Users/dev/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.azure"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gcloud"))
(deny file-write* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gcloud"))
(deny file-write* (subpath "/Users/dev/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.gcloud"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgcloud"))
(deny file-write* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-write* (subpath "/Users/dev/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.config%2Fgcloud"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.kube"))
(deny file-write* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.kube"))
(deny file-write* (subpath "/Users/dev/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.kube"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.ssh"))
(deny file-write* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.ssh"))
(deny file-write* (subpath "/Users/dev/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.ssh"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gnupg"))
(deny file-write* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gnupg"))
(deny file-write* (subpath "/Users/dev/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.gnupg"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.docker%2Fconfig.json"))
(deny file-write* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/Users/dev/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.netrc"))
(deny file-write* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.netrc"))
(deny file-write* (subpath "/Users/dev/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.netrc"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git-credentials"))
(deny file-write* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.git-credentials"))
(deny file-write* (subpath "/Users/dev/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git-credentials"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.pgpass"))
(deny file-write* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.pgpass"))
(deny file-write* (subpath "/Users/dev/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.pgpass"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgh"))
(deny file-write* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgh"))
(deny file-write* (subpath "/Users/dev/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.config%2Fgh"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fconfig"))
(deny file-write* (subpath "/Users/dev/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git%2Fconfig"))
(deny file-write* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks"))
(deny file-write* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks%2F%2A%2A"))
(deny file-write* (subpath "/Users/dev/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git%2Fhooks"))
(deny file-write* (regex #"^/Users/dev/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FUsers%2Fdev%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env"))
(deny file-read* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env"))
(deny file-read* (subpath "/Users/dev/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.env"))
(deny file-read* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.env.%2A"))
(deny file-read* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env.%2A"))
(deny file-read* (regex #"^/Users/dev/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.env.%2A"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.aws"))
(deny file-read* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.aws"))
(deny file-read* (subpath "/Users/dev/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.aws"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.azure"))
(deny file-read* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.azure"))
(deny file-read* (subpath "/Users/dev/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.azure"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gcloud"))
(deny file-read* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gcloud"))
(deny file-read* (subpath "/Users/dev/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.gcloud"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgcloud"))
(deny file-read* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-read* (subpath "/Users/dev/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.config%2Fgcloud"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.kube"))
(deny file-read* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.kube"))
(deny file-read* (subpath "/Users/dev/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.kube"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.ssh"))
(deny file-read* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.ssh"))
(deny file-read* (subpath "/Users/dev/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.ssh"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.gnupg"))
(deny file-read* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gnupg"))
(deny file-read* (subpath "/Users/dev/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.gnupg"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.docker%2Fconfig.json"))
(deny file-read* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/Users/dev/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.netrc"))
(deny file-read* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.netrc"))
(deny file-read* (subpath "/Users/dev/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.netrc"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git-credentials"))
(deny file-read* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.git-credentials"))
(deny file-read* (subpath "/Users/dev/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git-credentials"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.pgpass"))
(deny file-read* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.pgpass"))
(deny file-read* (subpath "/Users/dev/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.pgpass"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.config%2Fgh"))
(deny file-read* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgh"))
(deny file-read* (subpath "/Users/dev/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.config%2Fgh"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fconfig"))
(deny file-read* (subpath "/Users/dev/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git%2Fconfig"))
(deny file-read* (subpath "/Users/dev/Work/dev/safedep/pmg/sandbox/platform/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks"))
(deny file-read* (regex #"^/Users/dev/Work/dev/safedep/pmg/sandbox/platform/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2FWork%2Fdev%2Fsafedep%2Fpmg%2Fsandbox%2Fplatform%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/Users/dev/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git%2Fhooks"))
(deny file-read* (regex #"^/Users/dev/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FUsers%2Fdev%2F.git%2Fhooks%2F%2A%2A"))
;; Network access
;; Process execution
Reference in New Issue View Git Blame Copy Permalink