@landstrip/landstrip 0.16.18 → 0.16.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +25 -14
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -89,21 +89,32 @@ network:
|
|
|
89
89
|
allowNetwork: true
|
|
90
90
|
```
|
|
91
91
|
|
|
92
|
-
|
|
93
|
-
|
|
92
|
+
## Filesystem Policy
|
|
93
|
+
|
|
94
|
+
Write access is denied by default. `allowWrite` paths grant write access and
|
|
95
|
+
`denyWrite` paths subtract from them, with the most specific rule winning where
|
|
96
|
+
an allow and a deny overlap. Read access is unrestricted by default; setting
|
|
97
|
+
`denyRead` lowers it to an allowlist, and `allowRead` adds paths back.
|
|
98
|
+
|
|
99
|
+
### Write Denial Semantics
|
|
100
|
+
|
|
101
|
+
Concrete (non-glob) `denyWrite` paths are canonicalized and enforced
|
|
102
|
+
eagerly on all platforms.
|
|
103
|
+
|
|
104
|
+
Glob `denyWrite` patterns (`**/.env`, `**/*.pem`, etc.) behave differently
|
|
105
|
+
by platform:
|
|
106
|
+
|
|
107
|
+
- **Linux**: Globs are evaluated dynamically by the seccomp broker at each write
|
|
108
|
+
attempt. Files created after sandbox startup that match a denyWrite glob are
|
|
109
|
+
blocked. The glob is never walked at startup, so large trees do not cause
|
|
110
|
+
startup latency.
|
|
111
|
+
- **macOS**: Globs are snapshot-expanded when the Seatbelt profile is compiled.
|
|
112
|
+
Files created after `sandbox_init` are not protected by glob denies — use
|
|
113
|
+
concrete paths for those. A warning is logged when glob deny patterns are
|
|
114
|
+
used.
|
|
115
|
+
- **Windows**: Glob denyWrite entries are not enforced by the AppContainer
|
|
116
|
+
backend.
|
|
94
117
|
|
|
95
|
-
```json
|
|
96
|
-
{
|
|
97
|
-
"windows": {
|
|
98
|
-
"disableWin32k": true,
|
|
99
|
-
"disableExtensionPoints": true,
|
|
100
|
-
"strictHandleChecks": true,
|
|
101
|
-
"imageLoadNoRemote": true,
|
|
102
|
-
"imageLoadNoLowLabel": true,
|
|
103
|
-
"imageLoadPreferSystem32": true
|
|
104
|
-
}
|
|
105
|
-
}
|
|
106
|
-
```
|
|
107
118
|
|
|
108
119
|
## Network Policy
|
|
109
120
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@landstrip/landstrip",
|
|
3
|
-
"version": "0.16.
|
|
3
|
+
"version": "0.16.19",
|
|
4
4
|
"description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
|
|
5
5
|
"license": "Apache-2.0 AND LGPL-2.1-or-later",
|
|
6
6
|
"homepage": "https://github.com/landstrip/landstrip#readme",
|
|
@@ -24,10 +24,10 @@
|
|
|
24
24
|
"LICENSE-LGPL-2.1"
|
|
25
25
|
],
|
|
26
26
|
"optionalDependencies": {
|
|
27
|
-
"@landstrip/landstrip-darwin-arm64": "0.16.
|
|
28
|
-
"@landstrip/landstrip-darwin-x64": "0.16.
|
|
29
|
-
"@landstrip/landstrip-linux-x64": "0.16.
|
|
30
|
-
"@landstrip/landstrip-win32-x64": "0.16.
|
|
27
|
+
"@landstrip/landstrip-darwin-arm64": "0.16.19",
|
|
28
|
+
"@landstrip/landstrip-darwin-x64": "0.16.19",
|
|
29
|
+
"@landstrip/landstrip-linux-x64": "0.16.19",
|
|
30
|
+
"@landstrip/landstrip-win32-x64": "0.16.19"
|
|
31
31
|
},
|
|
32
32
|
"publishConfig": {
|
|
33
33
|
"access": "public"
|