OpenShell/crates/openshell-sandbox/testdata/sandbox-policy.yaml at 75f0ba52906b760134018534052c599c289320b6 · ericcurtin/OpenShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Minimal sandbox policy fixture for OPA engine tests.
# Covers the network policies, filesystem, and process config
# exercised by opa.rs unit tests.

version: 1

filesystem_policy:
  include_workdir: true
  read_only:
    - /usr
    - /lib
    - /proc
    - /dev/urandom
    - /app
    - /etc
    - /var/log
  read_write:
    - /sandbox
    - /tmp
    - /dev/null

landlock:
  compatibility: best_effort

process:
  run_as_user: sandbox
  run_as_group: sandbox

network_policies:
  claude_code:
    name: claude_code
    endpoints:
      - host: api.anthropic.com
        port: 443
        protocol: rest
        tls: terminate
        enforcement: enforce
        access: full
      - { host: statsig.anthropic.com, port: 443 }
    binaries:
      - { path: /usr/local/bin/claude }
      - { path: /usr/bin/node }

  github_ssh_over_https:
    name: github-ssh-over-https
    endpoints:
      - host: github.com
        port: 443
        protocol: rest
        tls: terminate
        enforcement: enforce
        rules:
          - allow:
              method: GET
              path: "/**/info/refs*"
          - allow:
              method: POST
              path: "/**/git-upload-pack"
    binaries:
      - { path: /usr/bin/git }

  copilot:
    name: copilot
    endpoints:
      - { host: github.com, port: 443 }
      - { host: api.github.com, port: 443 }
      - { host: api.githubcopilot.com, port: 443 }
      - { host: api.individual.githubcopilot.com, port: 443 }
      - { host: api.business.githubcopilot.com, port: 443 }
      - { host: api.enterprise.githubcopilot.com, port: 443 }
      - { host: copilot-proxy.githubusercontent.com, port: 443 }
      - { host: copilot-telemetry.githubusercontent.com, port: 443 }
      - { host: default.exp-tas.com, port: 443 }
      - { host: origin-tracker.githubusercontent.com, port: 443 }
      - { host: release-assets.githubusercontent.com, port: 443 }
    binaries:
      - { path: "/usr/lib/node_modules/@github/copilot/node_modules/@github/**/copilot" }
      - { path: /usr/local/bin/copilot }
      - { path: "/home/*/.local/bin/copilot" }
      - { path: /usr/bin/node }

  gitlab:
    name: gitlab
    endpoints:
      - { host: gitlab.com, port: 443 }
    binaries:
      - { path: /usr/bin/glab }