Repository navigation
Conversation
Add a scoped `keychain_access` setting (`read` or `readwrite`) to command sandbox policies. This selectively lifts the agent's macOS keychain deny for a specific command child without exposing keychain files or Mach services to the agent itself or requiring agent-level protection bypasses. Issue: #2092 Signed-off-by: Luke Hinds <lukehinds@gmail.com>
Contributor
PR Review SummarySize
Affected crates
Blast radius — BroadThis PR touches: source code,documentation,configuration / policy files Updated automatically on each push to this PR. |
Member
|
@panga let's see if this fixes the issue! |
Contributor
|
@SequeI could you also test credential-file access beyond macOS Keychain: AWS credentials/config, kubeconfig, npm .npmrc? My concern with NEP-0003 is the authorization model: a command should be able to receive scoped credential access without granting that access to the agent. The amendment should make this consistent for both Keychain and file-based credentials. |
Attribute macOS Seatbelt denials occurring inside a mediated command's own sandbox to its command policy and display targeted guidance in supervised diagnostic output. Agent-level flags like --read do not apply to command sandboxes, so the footer now directs users to update the command's policy in `command_policies.commands.<name>`. When `keychain_access` is set to "readwrite" (or when a keychain file grant with `--bypass-protection` is used), allow writing to the temporary `<db>.sb-XXXXXXXX-XXXXXX` files created during keychain save operations. Harden keychain directories against symlink and hard link creation to prevent malicious link swapping over keychain databases. - Track child PIDs created during command mediation in `MediatedPids` - Group and render mediated violations in `DiagnosticFormatter` - Permit regular-file writes on `.sb-*` temp paths in keychain policy - Disallow link creation and non-regular files in keychain directories - Update documentation on keychain save behavior and link hardening Signed-off-by: Luke Hinds <lukehinds@gmail.com>
Contributor
Author
|
I had to make some more changes to harden , will run some checks with tool sandboxing, although so far so good. |
Contributor
Author
|
and here is one password, I am not set up for kube etc , but this shows its good for more then one: |
Signed-off-by: Luke Hinds <lukehinds@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a scoped
keychain_accesssetting (readorreadwrite) to command sandbox policies. This selectively lifts the agent's macOS keychain deny for a specific command child without exposing keychain files or Mach services to the agent itself or requiring agent-level protection bypasses.Issue: #2092
Linked Issue
Closes #
Summary
Test Plan
Checklist