1787 lines
53 KiB
JSON
1787 lines
53 KiB
JSON
{
|
|
"schemaVersion": "1.0.0",
|
|
"operations": [
|
|
"fs.write.workspace",
|
|
"fs.write.outside_workspace",
|
|
"fs.delete.system_path",
|
|
"network.external",
|
|
"network.loopback",
|
|
"exec.startup_chain_extra",
|
|
"command.dangerous.system",
|
|
"fallback.backend_unavailable",
|
|
"permission.command.safe",
|
|
"permission.command.dangerous",
|
|
"permission.path.sensitive",
|
|
"permission.type.deny"
|
|
],
|
|
"permissionLists": {
|
|
"commandAllowlist": [
|
|
"bun",
|
|
"cargo",
|
|
"cat",
|
|
"cmake",
|
|
"cp",
|
|
"date",
|
|
"echo",
|
|
"env",
|
|
"find",
|
|
"git",
|
|
"grep",
|
|
"head",
|
|
"ls",
|
|
"make",
|
|
"mkdir",
|
|
"mv",
|
|
"node",
|
|
"npm",
|
|
"npx",
|
|
"pip",
|
|
"pip3",
|
|
"pnpm",
|
|
"pwd",
|
|
"python",
|
|
"python3",
|
|
"rustc",
|
|
"rustup",
|
|
"tail",
|
|
"touch",
|
|
"uv",
|
|
"which",
|
|
"yarn"
|
|
],
|
|
"commandDenylist": [
|
|
"apt install",
|
|
"apt-get install",
|
|
"brew install",
|
|
"chmod 777",
|
|
"chown",
|
|
"dnf install",
|
|
"masscan",
|
|
"nc -l",
|
|
"netcat",
|
|
"nmap",
|
|
"pacman -S",
|
|
"snap install",
|
|
"su",
|
|
"sudo",
|
|
"yum install"
|
|
],
|
|
"permissionTypeAutoApprove": [
|
|
"file:read"
|
|
],
|
|
"permissionTypeDeny": [
|
|
"package:install:system"
|
|
]
|
|
},
|
|
"rules": [
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace path is explicitly writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "block",
|
|
"reason": "seatbelt non-permissive mode only allows writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "block",
|
|
"reason": "seatbelt non-permissive mode only allows writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> (allow network*)",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> (allow network*)",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "block",
|
|
"reason": "strict mode does not include startupExecAllowlist",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked primarily by PermissionManager; sandbox outcome may vary by command path",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace path is explicitly writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "block",
|
|
"reason": "seatbelt non-permissive mode only allows writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "block",
|
|
"reason": "seatbelt non-permissive mode only allows writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> (allow network*)",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> (allow network*)",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "conditional",
|
|
"reason": "compat supports startupExecAllowlist but depends on caller input",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked primarily by PermissionManager; sandbox outcome may vary by command path",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace path is explicitly writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "allow",
|
|
"reason": "permissive mode enables file-write* globally",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "allow",
|
|
"reason": "permissive mode enables file-write* globally",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> (allow network*)",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> (allow network*)",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "permissive mode allows process-exec globally",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked primarily by PermissionManager; sandbox outcome may vary by command path",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "darwin",
|
|
"backend": "macos-seatbelt",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace path is bind-mounted writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "block",
|
|
"reason": "strict/compat keep host root read-only outside writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "block",
|
|
"reason": "strict/compat keep host root read-only outside writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> --unshare-net",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "loopback behavior depends on namespace/runtime tooling",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "conditional",
|
|
"reason": "strict only ro-binds minimal paths + command related dirs",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked by PermissionManager first; sandbox-level outcome varies by command/capability",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace path is bind-mounted writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "block",
|
|
"reason": "strict/compat keep host root read-only outside writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "block",
|
|
"reason": "strict/compat keep host root read-only outside writablePaths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "depends on networkEnabled -> --unshare-net",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "loopback behavior depends on namespace/runtime tooling",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "compat/permissive keep full root visibility for exec",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked by PermissionManager first; sandbox-level outcome varies by command/capability",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace path is bind-mounted writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "allow",
|
|
"reason": "permissive mode bind-mounts root writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "allow",
|
|
"reason": "permissive mode bind-mounts root writable",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "allow",
|
|
"reason": "permissive mode skips network namespace isolation",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "allow",
|
|
"reason": "no net namespace isolation in permissive mode",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "compat/permissive keep full root visibility for exec",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked by PermissionManager first; sandbox-level outcome varies by command/capability",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "linux",
|
|
"backend": "linux-bwrap",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "block",
|
|
"reason": "read-only mode blocks workspace write",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "block",
|
|
"reason": "read-only mode blocks writes",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "conditional",
|
|
"reason": "depends on helper ACL application and writable root boundary",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "read-only policy enforces no full network but relies on helper best-effort controls",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "read-only policy enforces no full network but relies on helper best-effort controls",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "helper executes command chain; restriction is policy/ACL not exec allowlist",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked mainly by PermissionManager and ACL boundaries",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace-write allows workspace root writes",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "conditional",
|
|
"reason": "strict limits writable_roots but helper still allows cwd/temp paths",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "conditional",
|
|
"reason": "depends on helper ACL application and writable root boundary",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "network_access is helper best-effort, not kernel-level isolation",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "network_access is helper best-effort, not kernel-level isolation",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "helper executes command chain; restriction is policy/ACL not exec allowlist",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked mainly by PermissionManager and ACL boundaries",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "strict",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "block",
|
|
"reason": "read-only mode blocks workspace write",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "block",
|
|
"reason": "read-only mode blocks writes",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "conditional",
|
|
"reason": "depends on helper ACL application and writable root boundary",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "read-only policy enforces no full network but relies on helper best-effort controls",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "read-only policy enforces no full network but relies on helper best-effort controls",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "helper executes command chain; restriction is policy/ACL not exec allowlist",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked mainly by PermissionManager and ACL boundaries",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace-write allows workspace root writes",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "conditional",
|
|
"reason": "compat/permissive include wider writable roots and cwd-dependent allowances",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "conditional",
|
|
"reason": "depends on helper ACL application and writable root boundary",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "network_access is helper best-effort, not kernel-level isolation",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "network_access is helper best-effort, not kernel-level isolation",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "helper executes command chain; restriction is policy/ACL not exec allowlist",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked mainly by PermissionManager and ACL boundaries",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "compat",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "block",
|
|
"reason": "read-only mode blocks workspace write",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "block",
|
|
"reason": "read-only mode blocks writes",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "conditional",
|
|
"reason": "depends on helper ACL application and writable root boundary",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "read-only policy enforces no full network but relies on helper best-effort controls",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "read-only policy enforces no full network but relies on helper best-effort controls",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "helper executes command chain; restriction is policy/ACL not exec allowlist",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked mainly by PermissionManager and ACL boundaries",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "read-only",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "allow",
|
|
"reason": "workspace-write allows workspace root writes",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "conditional",
|
|
"reason": "compat/permissive include wider writable roots and cwd-dependent allowances",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "conditional",
|
|
"reason": "depends on helper ACL application and writable root boundary",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "network.external",
|
|
"verdict": "conditional",
|
|
"reason": "network_access is helper best-effort, not kernel-level isolation",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "network.loopback",
|
|
"verdict": "conditional",
|
|
"reason": "network_access is helper best-effort, not kernel-level isolation",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "allow",
|
|
"reason": "helper executes command chain; restriction is policy/ACL not exec allowlist",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "conditional",
|
|
"reason": "blocked mainly by PermissionManager and ACL boundaries",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "win32",
|
|
"backend": "windows-sandbox",
|
|
"mode": "permissive",
|
|
"windowsMode": "workspace-write",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "conditional",
|
|
"reason": "manual fails closed; startup-only/session degrade to none",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts",
|
|
"src/main/services/sandbox/policy.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "strict",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "compat",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.workspace",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.write.outside_workspace",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fs.delete.system_path",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.external",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "network.loopback",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "exec.startup_chain_extra",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "command.dangerous.system",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "sandbox",
|
|
"platform": "all",
|
|
"backend": "docker",
|
|
"mode": "permissive",
|
|
"windowsMode": "n/a",
|
|
"operationId": "fallback.backend_unavailable",
|
|
"verdict": "unsupported",
|
|
"reason": "docker process-level sandbox is not implemented",
|
|
"evidence": [
|
|
"src/main/services/sandbox/SandboxInvoker.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "permission",
|
|
"platform": "all",
|
|
"backend": "permission-manager",
|
|
"mode": "n/a",
|
|
"windowsMode": "n/a",
|
|
"operationId": "permission.command.safe",
|
|
"verdict": "allow",
|
|
"reason": "safeCommands includes \"node\" and is auto-approved for command:execute",
|
|
"evidence": [
|
|
"src/main/services/sandbox/PermissionManager.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "permission",
|
|
"platform": "all",
|
|
"backend": "permission-manager",
|
|
"mode": "n/a",
|
|
"windowsMode": "n/a",
|
|
"operationId": "permission.command.dangerous",
|
|
"verdict": "block",
|
|
"reason": "dangerous command pattern (e.g. \"sudo\") is blocked",
|
|
"evidence": [
|
|
"src/main/services/sandbox/PermissionManager.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "permission",
|
|
"platform": "all",
|
|
"backend": "permission-manager",
|
|
"mode": "n/a",
|
|
"windowsMode": "n/a",
|
|
"operationId": "permission.path.sensitive",
|
|
"verdict": "block",
|
|
"reason": "sensitive paths (.ssh, /etc/passwd, /etc/shadow, /etc/sudoers, /etc/group) are blocked",
|
|
"evidence": [
|
|
"src/main/services/sandbox/PermissionManager.ts"
|
|
]
|
|
},
|
|
{
|
|
"layer": "permission",
|
|
"platform": "all",
|
|
"backend": "permission-manager",
|
|
"mode": "n/a",
|
|
"windowsMode": "n/a",
|
|
"operationId": "permission.type.deny",
|
|
"verdict": "block",
|
|
"reason": "denyList permission types are blocked",
|
|
"evidence": [
|
|
"src/main/services/sandbox/PermissionManager.ts"
|
|
]
|
|
}
|
|
]
|
|
}
|