mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Abhisek DattaandGitHub
c601e17cdc
* fix: Sandbox profile for Go ecosystem * fix: Sandbox violations for network bind
118 lines
4.1 KiB
YAML
118 lines
4.1 KiB
YAML
name: go
|
|
description: Sandbox policy for the Go module ecosystem (go command)
|
|
package_managers:
|
|
- go
|
|
|
|
# go run executes the built program in the foreground and may need a TTY.
|
|
allow_pty: true
|
|
|
|
# Localhost-only listening (same as npx/uvx/pipx): go test commonly binds
|
|
# httptest servers, and go run workloads often serve locally. Non-localhost
|
|
# binds and outbound traffic are unaffected.
|
|
allow_network_bind: true
|
|
|
|
# .git/config stays blocked (default). go build embeds VCS info by default
|
|
# (-buildvcs=auto) which invokes git; if git fails on the blocked config, build
|
|
# with -buildvcs=false or set allow_git_config: true in a custom profile.
|
|
|
|
filesystem:
|
|
allow_read:
|
|
# Root read is required for toolchain discovery: GOROOT can live anywhere
|
|
# (/usr/local/go, Homebrew, distro packages, asdf, golang.org/dl SDKs).
|
|
# This is safe because deny rules have higher precedence and dangerous
|
|
# files (.env, .ssh, .aws, .gnupg, etc.) are blocked by mandatory deny
|
|
# patterns.
|
|
- /
|
|
- ${CWD}/**
|
|
- ${HOME}/go/**
|
|
- ${HOME}/.config/go/**
|
|
- ${HOME}/Library/Caches/go-build/**
|
|
- ${HOME}/.cache/go-build/**
|
|
|
|
allow_write:
|
|
# Note: ${TMPDIR} is automatically allowed when write restrictions are enabled (macOS)
|
|
# Note: On macOS, /tmp is a symlink to /private/tmp, so we need both
|
|
- /tmp/**
|
|
- /private/tmp/**
|
|
- /var/tmp/**
|
|
# go build/test write output binaries and generated files anywhere in the
|
|
# project (e.g. go build -o bin/app). Unlike npm/PyPI, the Go ecosystem has
|
|
# no install-time script execution: module code only runs via go run /
|
|
# go test / go generate, and credential files inside the project stay
|
|
# blocked by the mandatory deny patterns.
|
|
- ${CWD}/**
|
|
# Default GOPATH: module cache and sumdb cache (pkg/mod), go install
|
|
# target (bin).
|
|
- ${HOME}/go/**
|
|
# Default GOCACHE build cache (macOS, Linux)
|
|
- ${HOME}/Library/Caches/go-build/**
|
|
- ${HOME}/.cache/go-build/**
|
|
# Local telemetry counters written by the go tool on every invocation
|
|
- ${HOME}/Library/Application Support/go/telemetry/**
|
|
- ${HOME}/.config/go/telemetry/**
|
|
|
|
deny_read: []
|
|
|
|
deny_write:
|
|
# Additional system directories to protect
|
|
- /etc/**
|
|
- /usr/**
|
|
|
|
network:
|
|
# Per-host rules are NOT enforced on any platform. macOS Seatbelt and Linux
|
|
# Bubblewrap only make a binary decision: any allow_outbound entry enables
|
|
# ALL outbound traffic, and "*:*" in deny_outbound disables the network
|
|
# entirely only when allow_outbound is empty. The hosts below document the
|
|
# default Go module endpoints and keep the network enabled; actual module
|
|
# traffic control comes from the PMG proxy's fail-closed GOPROXY rewrite.
|
|
allow_outbound:
|
|
- proxy.golang.org:443
|
|
- sum.golang.org:443
|
|
- index.golang.org:443
|
|
|
|
deny_outbound:
|
|
- "*:*"
|
|
|
|
environment:
|
|
# Go toolchain variables (GOPROXY, GOFLAGS, CGO_*, CC, CXX) and the
|
|
# PMG-injected proxy/cert variables are not on the DANGEROUS_ENV_VARS scrub
|
|
# list, so they pass through without an allow entry. Deliberately no GO*
|
|
# re-allow here: that glob would also re-allow GOOGLE_* cloud credentials,
|
|
# which must stay scrubbed.
|
|
allow: []
|
|
|
|
process:
|
|
allow_exec:
|
|
# Go toolchain: official installer, distro packages, Homebrew
|
|
- /usr/local/go/**
|
|
- /usr/local/bin/go
|
|
- /usr/bin/go
|
|
- /usr/lib/go*/**
|
|
- /opt/homebrew/bin/go
|
|
- /opt/homebrew/Cellar/go/**
|
|
# golang.org/dl SDKs and version manager shims
|
|
- ${HOME}/sdk/go*/**
|
|
- ${HOME}/.asdf/shims/go
|
|
# Toolchains downloaded via GOTOOLCHAIN are exec'd from the module cache
|
|
- ${HOME}/go/pkg/mod/golang.org/toolchain@*/**
|
|
# go run / go test execute freshly built binaries from the build cache and
|
|
# the per-build temp work directory
|
|
- ${HOME}/Library/Caches/go-build/**
|
|
- ${HOME}/.cache/go-build/**
|
|
- /tmp/**
|
|
- ${TMPDIR}/**
|
|
# cgo toolchain and VCS stamping (-buildvcs)
|
|
- /usr/bin/gcc
|
|
- /usr/bin/clang
|
|
- /usr/bin/cc
|
|
- /usr/bin/git
|
|
- /usr/local/bin/git
|
|
# Required for shims (e.g., asdf) that use #!/usr/bin/env bash
|
|
- /bin/bash
|
|
- /bin/sh
|
|
- /usr/bin/env
|
|
|
|
deny_exec:
|
|
- /usr/bin/curl
|
|
- /usr/bin/wget
|