feat(policy): detect destructive command chaining in exec strings
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 45/100
Línea de trabajo
Comienza comparando openshell-sandbox/data/sandbox-policy.rego, la ruta de políticas YAML a través de openshell-prover y los filtros a nivel de Rust en el crate sandbox. Rastrea dónde sigue disponible la cadena de comando sin procesar antes de execve y, después, define pruebas para primitivas destructivas unidas mediante &&, punto y coma o pipelines, y para las excepciones de operadores.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Running OpenShell on a Mac Mini M4 (Docker Desktop) to sandbox coding agents, same setup I flagged in #745. Ran into an adjacent gap in what actually gets enforced.
Binary-level policy (seccomp, Landlock) allows rm, dd, mkfs, shred for legit use. That's fine. The problem isn't running them individually, it's chaining them in a single exec string:
rm -rf /data && dd if=/dev/zero of=/dev/sda
That ships as one command. Each binary is allowed. The chain is what does the damage.
&& is the one I've actually hit. ; and stuff like find ... | xargs rm show up too. Subshells/backticks are possible, but I haven't seen those in practice. Landlock and seccomp only see individual execve calls, so none of this composition is visible at that layer. It all exists at the shell level.
Want a policy that looks at the raw command string before execve, and blocks when multiple destructive primitives are chained together. Then let operators carve out exemptions where that pattern is actually intentional.
Simple string inspection with awareness of chaining operators is probably enough for this class of issue. Full AST parsing feels like overkill and fragile. A small set of dangerous primitives (rm, dd, mkfs, shred, maybe fdisk, diskutil) covers most of the high-risk cases.
This is a guardrail, not perfect detection. Some legit workflows will trip it, and that's what exemptions are for.
#745 covers visibility into which layers are active. This is the adjacent gap: what gets enforced semantically, while the full command string still exists pre-execve.
Not sure where this should live. I see openshell-sandbox/data/sandbox-policy.rego, YAML policies via openshell-prover, and Rust-level filters in the sandbox crate. Would want direction before picking a lane.
- Lenguaje dominante
- Rust
- Estrellas
- 8.7k
- Forks
- 1.3k
- Merge medio
- 2 d 7 h
- PR fusionados (30 d)
- 243
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de NVIDIA/OpenShell
-
area:docs
Dificultad 1/5 Menos de una hora Aptitud para principiantes 88/100
-
state:triage-needed
Dificultad 2/5 1-3 horas Aptitud para principiantes 82/100
-
area:cli state:validated
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
-
state:triage-needed
Dificultad 1/5 Menos de una hora Aptitud para principiantes 90/100
-
area:build spike state:review-ready state:stale
Dificultad 2/5 Medio día Aptitud para principiantes 68/100
Todos los issues de NVIDIA/OpenShell
Issues similares
-
risk:low runtime status:in-progress type:test
Dificultad 1/5 Menos de una hora Aptitud para principiantes 92/100
zeroclaw-labs/zeroclaw#11023 ·
-
good first issue refactor
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
EricSpencer00/Resilient#4835 · 1 comentario ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 74/100
bisq-network/bisq-musig#204 ·
-
agent:ready documentation
Dificultad 2/5 1-3 horas Aptitud para principiantes 88/100
cesarferreira/stax#890 ·