Repository navigation
fix(approval): apply saved deny rules to safe shell commands and bash -c bodies - #1138
Draft
sosidudku1 wants to merge 2 commits into
Draft
sosidudku1 wants to merge 2 commits into
sosidudku1 wants to merge 2 commits into
Conversation
…ed shell -c lines A command the shell guard deems safe (echo, ls) never reached the approval gate, so a saved deny rule on it did not apply. os.shell.run now asks the gate's rule decision for such a command and sends a deny to the gate, which refuses it before any level, grant or prompt. Ask and allow rules keep their current semantics. shellRuleSegments now also lists the commands a nested bash/sh/zsh -c line runs (bundled flags like -lc, -ec, recursively, bounded depth), so a deny rule on rm stops bash -c "rm -rf tmp". The nested-shell option scan is shared with the guard's dangerous layer. Refs ATO-1332
…ted shells Saved deny rules now also see the command behind: - csh, tcsh and fish -c (fish -C too), and + options (+x, +o pipefail) before -c; the nested-shell list and the wrapper flag table are shared with the guard's browser-bypass layer - value-taking wrapper flags (sudo -u root, nice -n 5, timeout 5 / -s KILL, env -u X / -S, xargs -n 1) - eval and find -exec A script fed to a bare shell or interpreter through a pipe, a redirect or a heredoc (printf ... | sh, sh < run.sh, curl ... | python3) cannot be read, so the request is marked commandUnreadable and any deny or ask command rule matches it; the refusal says why. Allow rules are unchanged. Refs ATO-1332
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Several gaps let a saved deny rule be skipped:
echo,ls) never reached the approval gate, so a deny rule on them did not apply.bash -c "…"were not split into segments, so a deny rule onrmdid not stopbash -c "rm -rf tmp".timeout 5,sudo -u root,nice -n 5,env -u X),eval,xargs,find -exec, and a script piped into a bare shell (printf 'rm -rf tmp' | sh) hid the real command.Now:
os.shell.runasks the gate's rule decision for a safe command too. A deny goes to the gate, which refuses it on the rule before any level, grant or prompt (level 5 included).bash/sh/zsh/dash/ksh/fish/csh/tcshline runs:-calone or bundled (-lc,-ec),--command, fish-C/--init-command,+x/+eoptions and+o/+Ovalues, recursively up to 4 levels.sudo,nice,timeout,envincl.VAR=valand-S,xargs,find -exec);evaljoins its words and re-splits them. The shell list and the wrapper table now live once incommand-segments.tsand are shared with the browser-bypass guard (identical tables, same verdicts).sh,bash,python*,node,ruby,perl,php,osascript) that has no script of its own, the rule check cannot read what runs. Such a line is matched by any command deny or ask rule, so it is refused (or asked) when at least one exists. The refusal says why. With no rules, or only allow rules, it runs as before.Allow rules still match only the top-level command. Ask rules still do not prompt on safe commands.
Why
"Never allow X" has to mean never: past wrappers, nested shells,
evalandfind -exec, and a script piped into a shell is refused under a deny rule.Trade-offs
python3 - <<'EOF'andcurl … | bashare refused (deny) or asked (ask), even if the rule names an unrelated command.echo bash -c "rm x"is also refused by anrmdeny rule.fish/csh/tcsh -candbash +x -care nowdangerous.shell_dash_ctoo (stricter).bun/denoon stdin are not covered).Tests
shell-saved-deny-rules.test.ts(level 5,tmpsurvives, nobody is asked):echo hiandls ./under their own deny rules;bash -c,sh -lc,tcsh -c,csh -c,fish -c,bash +x -c,sh +e -c;timeout 5,timeout -s KILL 5,sudo -u root,nice -n 5,env -u X,eval rm -rf tmp,echo tmp | xargs rm -rf,printf 'rm -rf tmp' | sh; an unrelated deny still runsecho hi; ask onechodoes not prompt; allow onrmdoes not settle the nested form; no rules → piped scripts run as before.shell-command-argv.test.ts: each unwrap, and what the stdin check flags and does not flag.approval-rules.test.ts: an unreadable request is matched by deny and ask rules, not by allow.Fixes ATO-1332.
Not yet checked on the second Mac.