Trusted Remote Execution (REX)

REX is a secure script execution engine that uses Cedar policies to authorize every system operation a script performs. Scripts are written in Rhai and run inside a sandboxed environment where file I/O, network access, process management, and system queries are each gated by fine-grained Cedar authorization checks.

Cedar is a language for writing and enforcing authorization policies. REX integrates Cedar so that each API call — opening a file, reading a directory, resolving a hostname — is authorized against a declared policy before execution. This gives operators precise control over what a script can and cannot do.

Key Properties

• Cedar-authorized — every resource access is checked against a Cedar policy at runtime
• TOCTOU-mitigated — file descriptors are used instead of paths where possible, reducing symlink and race-condition attacks
• Sandboxed — scripts run in Rhai with no direct access to the host; all operations go through authorized Rust APIs

Quick Start

1. Install rex-runner

cargo install rex-runner

2. Create a policy file

cat > rex-policy.cedar << 'EOF'
// Allow opening /tmp on Linux, or /private/tmp on macOS (symlink target)
permit(
    principal,
    action in [file_system::Action::"open"],
    resource
) when {
    resource == file_system::Dir::"/tmp" ||
    resource == file_system::Dir::"/private/tmp"
};

// Allow opening, reading, writing, and creating the file on either platform
permit(
    principal,
    action in [file_system::Action::"open", file_system::Action::"read",
               file_system::Action::"write", file_system::Action::"create"],
    resource
) when {
    resource == file_system::File::"/tmp/rex-hello-world" ||
    resource == file_system::File::"/private/tmp/rex-hello-world"
};
EOF

3. Create a script file

cat > rex-script.rhai << 'EOF'
// Build the file path from the script argument
let path = "/tmp/" + file_name;

// Write a greeting to the file (replace mode overwrites if it already exists)
write([write::replace], path, "Hello from REX!\n");

// Read and return the file contents
let contents = cat(path);
contents
EOF

4. Create a script arguments file

cat > rex-script-args.json << 'EOF'
{
  "file_name": { "stringValue": "rex-hello-world" }
}
EOF

5. Run the script

rex-runner \
  --script-file rex-script.rhai \
  --policy-file rex-policy.cedar \
  --script-arguments-file rex-script-args.json \
  --output-format human

Try it: Remove one of the permit statements from rex-policy.cedar and re-run the script. REX will deny the unauthorized operation and return an authorization error, demonstrating that the policy is enforced at runtime.

Workspace Structure

The workspace is organized into three layers:

Core

Rust SDK

Safe Rust implementations of system operations, each with Cedar authorization:

Rhai SDK

Rhai bindings that expose the Rust SDK to scripts:

Building

To build, simply run cargo build --workspace (or cargo build --workspace --release).

Testing

cargo test --workspace

Documentation

• Cedar Policy Guide — how Cedar entities, actions, and attributes map to REX operations
• Cedar Policy Language — official Cedar documentation
• Runner — how to run scripts locally
• Contributing — development setup and guidelines