feat(policy): detect destructive command chaining in exec strings
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 45/100
Research direction
Start by comparing openshell-sandbox/data/sandbox-policy.rego, the YAML policy path through openshell-prover, and the Rust-level filters in the sandbox crate. Trace where the raw command string remains available before execve, then define tests for destructive primitives joined by &&, semicolons, or pipelines and for operator exemptions.
Written by the indexing model from the issue text.
Description
Running OpenShell on a Mac Mini M4 (Docker Desktop) to sandbox coding agents, same setup I flagged in #745. Ran into an adjacent gap in what actually gets enforced.
Binary-level policy (seccomp, Landlock) allows rm, dd, mkfs, shred for legit use. That's fine. The problem isn't running them individually, it's chaining them in a single exec string:
rm -rf /data && dd if=/dev/zero of=/dev/sda
That ships as one command. Each binary is allowed. The chain is what does the damage.
&& is the one I've actually hit. ; and stuff like find ... | xargs rm show up too. Subshells/backticks are possible, but I haven't seen those in practice. Landlock and seccomp only see individual execve calls, so none of this composition is visible at that layer. It all exists at the shell level.
Want a policy that looks at the raw command string before execve, and blocks when multiple destructive primitives are chained together. Then let operators carve out exemptions where that pattern is actually intentional.
Simple string inspection with awareness of chaining operators is probably enough for this class of issue. Full AST parsing feels like overkill and fragile. A small set of dangerous primitives (rm, dd, mkfs, shred, maybe fdisk, diskutil) covers most of the high-risk cases.
This is a guardrail, not perfect detection. Some legit workflows will trip it, and that's what exemptions are for.
#745 covers visibility into which layers are active. This is the adjacent gap: what gets enforced semantically, while the full command string still exists pre-execve.
Not sure where this should live. I see openshell-sandbox/data/sandbox-policy.rego, YAML policies via openshell-prover, and Rust-level filters in the sandbox crate. Would want direction before picking a lane.
- Dominant language
- Rust
- Stars
- 8.7k
- Forks
- 1.3k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 243
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from NVIDIA/OpenShell
-
area:docs
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
state:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
area:cli state:validated
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
state:triage-needed
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
area:build spike state:review-ready state:stale
Difficulty 2/5 Half a day Newbie friendliness 68/100
All issues in NVIDIA/OpenShell
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100