@machina.ai/cell-cli 1.57.0-rc1 → 1.59.0-rc2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/dist/package.json +3 -3
  2. package/dist/src/generated/git-commit.d.ts +2 -2
  3. package/dist/src/generated/git-commit.js +2 -2
  4. package/dist/src/ui/components/AsciiArt.d.ts +6 -6
  5. package/dist/src/ui/components/AsciiArt.js +6 -6
  6. package/dist/src/ui/hooks/useGeminiStream.js +0 -1
  7. package/dist/src/ui/hooks/useGeminiStream.js.map +1 -1
  8. package/dist/src/ui/hooks/useQuotaAndFallback.js +4 -1
  9. package/dist/src/ui/hooks/useQuotaAndFallback.js.map +1 -1
  10. package/dist/src/utils/handleAutoUpdate.test.js +2 -2
  11. package/dist/src/utils/sandbox-macos-permissive-open.sb +50 -0
  12. package/dist/src/utils/sandbox-macos-permissive-proxied.sb +50 -0
  13. package/dist/src/utils/sandbox-macos-profiles.test.js +53 -0
  14. package/dist/src/utils/sandbox-macos-profiles.test.js.map +1 -1
  15. package/dist/src/utils/sandbox-macos-restrictive-open.sb +49 -0
  16. package/dist/src/utils/sandbox-macos-restrictive-proxied.sb +50 -0
  17. package/dist/src/utils/sandbox-macos-strict-open.sb +50 -0
  18. package/dist/src/utils/sandbox-macos-strict-proxied.sb +50 -0
  19. package/dist/src/utils/sandboxBuiltinProfiles.js +252 -6
  20. package/dist/src/utils/sandboxBuiltinProfiles.js.map +1 -1
  21. package/dist/tsconfig.tsbuildinfo +1 -1
  22. package/package.json +3 -3
package/dist/src/utils/sandbox-macos-profiles.test.js CHANGED
@@ -7,6 +7,7 @@ import { describe, it, expect } from 'vitest';
7
7
  import { readFileSync } from 'node:fs';
8
8
  import { fileURLToPath } from 'node:url';
9
9
  import path from 'node:path';
10
+ import { BUILTIN_SEATBELT_PROFILE_CONTENTS } from './sandboxBuiltinProfiles.js';
10
11
  const utilsDir = path.dirname(fileURLToPath(import.meta.url));
11
12
  /**
12
13
  * Strip SBPL comments (`; ...` to end of line) so assertions run against the
@@ -22,6 +23,14 @@ function readRules(profile) {
22
23
  })
23
24
  .join('\n');
24
25
  }
26
+ const ALL_PROFILES = [
27
+ 'sandbox-macos-permissive-open.sb',
28
+ 'sandbox-macos-permissive-proxied.sb',
29
+ 'sandbox-macos-restrictive-open.sb',
30
+ 'sandbox-macos-restrictive-proxied.sb',
31
+ 'sandbox-macos-strict-open.sb',
32
+ 'sandbox-macos-strict-proxied.sb',
33
+ ];
25
34
  const PERMISSIVE_PROFILES = [
26
35
  'sandbox-macos-permissive-open.sb',
27
36
  'sandbox-macos-permissive-proxied.sb',
@@ -62,4 +71,48 @@ describe('macOS permissive Seatbelt profiles', () => {
62
71
  expect(rules).not.toMatch(/\(allow network-outbound\)/);
63
72
  });
64
73
  });
74
+ describe('macOS Seatbelt container runtime isolation', () => {
75
+ describe.each(ALL_PROFILES)('%s', (profile) => {
76
+ const rules = readRules(profile);
77
+ it('denies access to Docker daemon sockets', () => {
78
+ expect(rules).toContain('(literal "/var/run/docker.sock")');
79
+ expect(rules).toContain('(literal "/private/var/run/docker.sock")');
80
+ expect(rules).toContain('(subpath (string-append (param "HOME_DIR") "/.docker/run"))');
81
+ });
82
+ it('denies execution of container runtime binaries', () => {
83
+ expect(rules).toContain('(literal "/usr/local/bin/docker")');
84
+ expect(rules).toContain('(literal "/usr/bin/docker")');
85
+ expect(rules).toContain('(literal "/opt/homebrew/bin/docker")');
86
+ expect(rules).toContain('(literal "/opt/homebrew/bin/podman")');
87
+ expect(rules).toContain('(literal "/opt/homebrew/bin/colima")');
88
+ });
89
+ it('denies Docker Mach/XPC service lookups', () => {
90
+ expect(rules).toContain('(xpc-service-name-prefix "com.docker.")');
91
+ expect(rules).toContain('(global-name-prefix "com.docker.")');
92
+ });
93
+ it('denies Docker POSIX shared memory', () => {
94
+ expect(rules).toContain('(ipc-posix-name-prefix "docker")');
95
+ expect(rules).toContain('(ipc-posix-name-prefix "com.docker.")');
96
+ });
97
+ });
98
+ });
99
+ describe('BUILTIN_SEATBELT_PROFILE_CONTENTS consistency', () => {
100
+ const profileKeyMap = {
101
+ 'sandbox-macos-permissive-open.sb': 'permissive-open',
102
+ 'sandbox-macos-permissive-proxied.sb': 'permissive-proxied',
103
+ 'sandbox-macos-restrictive-open.sb': 'restrictive-open',
104
+ 'sandbox-macos-restrictive-proxied.sb': 'restrictive-proxied',
105
+ 'sandbox-macos-strict-open.sb': 'strict-open',
106
+ 'sandbox-macos-strict-proxied.sb': 'strict-proxied',
107
+ };
108
+ describe.each(Object.entries(profileKeyMap))('%s matches embedded %s', (file, key) => {
109
+ it('contains container isolation rules in embedded content', () => {
110
+ const embeddedContent = BUILTIN_SEATBELT_PROFILE_CONTENTS[key];
111
+ expect(embeddedContent).toBeDefined();
112
+ expect(embeddedContent).toContain('(literal "/var/run/docker.sock")');
113
+ expect(embeddedContent).toContain('(literal "/usr/local/bin/docker")');
114
+ expect(embeddedContent).toContain('(xpc-service-name-prefix "com.docker.")');
115
+ });
116
+ });
117
+ });
65
118
  //# sourceMappingURL=sandbox-macos-profiles.test.js.map
package/dist/src/utils/sandbox-macos-profiles.test.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"sandbox-macos-profiles.test.js","sourceRoot":"","sources":["../../../src/utils/sandbox-macos-profiles.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SACtD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,kCAAkC;IAClC,qCAAqC;CACtC,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,sCAAsC;AACtC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,wDAAwD,CACzD,CAAC;QACF,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"sandbox-macos-profiles.test.js","sourceRoot":"","sources":["../../../src/utils/sandbox-macos-profiles.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SACtD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,kCAAkC;IAClC,qCAAqC;IACrC,mCAAmC;IACnC,sCAAsC;IACtC,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,kCAAkC;IAClC,qCAAqC;CACtC,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,sCAAsC;AACtC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,wDAAwD,CACzD,CAAC;QACF,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,6DAA6D,CAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,MAAM,aAAa,GAA2B;QAC5C,kCAAkC,EAAE,iBAAiB;QACrD,qCAAqC,EAAE,oBAAoB;QAC3D,mCAAmC,EAAE,kBAAkB;QACvD,sCAAsC,EAAE,qBAAqB;QAC7D,8BAA8B,EAAE,aAAa;QAC7C,iCAAiC,EAAE,gBAAgB;KACpD,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAC1C,wBAAwB,EACxB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACZ,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YACvE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,yCAAyC,CAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}
package/dist/src/utils/sandbox-macos-restrictive-open.sb CHANGED
@@ -93,3 +93,52 @@
93
93
 
94
94
  ;; allow all outbound network traffic
95
95
  (allow network-outbound)
96
+
97
+ ;; Block Docker & container daemon UNIX domain sockets (read & write)
98
+ (deny file-read* file-write*
99
+ (literal "/var/run/docker.sock")
100
+ (literal "/var/run/docker.sock.raw")
101
+ (literal "/private/var/run/docker.sock")
102
+ (literal "/private/var/run/docker.sock.raw")
103
+ (subpath "/var/run/docker")
104
+ (subpath "/private/var/run/docker")
105
+ (subpath "/Users/Shared/.docker")
106
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
107
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
108
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
109
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
110
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
111
+ )
112
+
113
+ ;; Block container CLI and daemon binaries from execution
114
+ (deny process-exec
115
+ (literal "/usr/local/bin/docker")
116
+ (literal "/usr/local/bin/dockerd")
117
+ (literal "/usr/local/bin/docker-compose")
118
+ (literal "/usr/bin/docker")
119
+ (literal "/opt/homebrew/bin/docker")
120
+ (literal "/opt/homebrew/bin/dockerd")
121
+ (literal "/opt/homebrew/bin/docker-compose")
122
+ (literal "/opt/homebrew/bin/podman")
123
+ (literal "/usr/local/bin/podman")
124
+ (literal "/opt/homebrew/bin/colima")
125
+ (literal "/usr/local/bin/colima")
126
+ (literal "/opt/homebrew/bin/orb")
127
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
128
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
129
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
130
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
131
+ )
132
+
133
+ ;; Block com.docker.* and container manager Mach lookup / XPC services
134
+ (deny mach-lookup
135
+ (xpc-service-name-prefix "com.docker.")
136
+ (global-name-prefix "com.docker.")
137
+ (global-name-prefix "dev.kdrag0n.OrbStack")
138
+ )
139
+
140
+ ;; Block Docker POSIX Shared Memory
141
+ (deny ipc-posix-shm*
142
+ (ipc-posix-name-prefix "docker")
143
+ (ipc-posix-name-prefix "com.docker.")
144
+ )
package/dist/src/utils/sandbox-macos-restrictive-proxied.sb CHANGED
@@ -95,3 +95,53 @@
95
95
  ;; set `CELL_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
96
96
  ;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
97
97
  (allow network-outbound (remote tcp "localhost:8877"))
98
+
99
+ ;; Block Docker & container daemon UNIX domain sockets (read & write)
100
+ (deny file-read* file-write*
101
+ (literal "/var/run/docker.sock")
102
+ (literal "/var/run/docker.sock.raw")
103
+ (literal "/private/var/run/docker.sock")
104
+ (literal "/private/var/run/docker.sock.raw")
105
+ (subpath "/var/run/docker")
106
+ (subpath "/private/var/run/docker")
107
+ (subpath "/Users/Shared/.docker")
108
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
109
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
110
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
111
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
112
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
113
+ )
114
+
115
+ ;; Block container CLI and daemon binaries from execution
116
+ (deny process-exec
117
+ (literal "/usr/local/bin/docker")
118
+ (literal "/usr/local/bin/dockerd")
119
+ (literal "/usr/local/bin/docker-compose")
120
+ (literal "/usr/bin/docker")
121
+ (literal "/opt/homebrew/bin/docker")
122
+ (literal "/opt/homebrew/bin/dockerd")
123
+ (literal "/opt/homebrew/bin/docker-compose")
124
+ (literal "/opt/homebrew/bin/podman")
125
+ (literal "/usr/local/bin/podman")
126
+ (literal "/opt/homebrew/bin/colima")
127
+ (literal "/usr/local/bin/colima")
128
+ (literal "/opt/homebrew/bin/orb")
129
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
130
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
131
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
132
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
133
+ )
134
+
135
+ ;; Block com.docker.* and container manager Mach lookup / XPC services
136
+ (deny mach-lookup
137
+ (xpc-service-name-prefix "com.docker.")
138
+ (global-name-prefix "com.docker.")
139
+ (global-name-prefix "dev.kdrag0n.OrbStack")
140
+ )
141
+
142
+ ;; Block Docker POSIX Shared Memory
143
+ (deny ipc-posix-shm*
144
+ (ipc-posix-name-prefix "docker")
145
+ (ipc-posix-name-prefix "com.docker.")
146
+ )
147
+
package/dist/src/utils/sandbox-macos-strict-open.sb CHANGED
@@ -128,3 +128,53 @@
128
128
 
129
129
  ;; allow all outbound network traffic
130
130
  (allow network-outbound)
131
+
132
+ ;; Block Docker & container daemon UNIX domain sockets (read & write)
133
+ (deny file-read* file-write*
134
+ (literal "/var/run/docker.sock")
135
+ (literal "/var/run/docker.sock.raw")
136
+ (literal "/private/var/run/docker.sock")
137
+ (literal "/private/var/run/docker.sock.raw")
138
+ (subpath "/var/run/docker")
139
+ (subpath "/private/var/run/docker")
140
+ (subpath "/Users/Shared/.docker")
141
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
142
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
143
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
144
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
145
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
146
+ )
147
+
148
+ ;; Block container CLI and daemon binaries from execution
149
+ (deny process-exec
150
+ (literal "/usr/local/bin/docker")
151
+ (literal "/usr/local/bin/dockerd")
152
+ (literal "/usr/local/bin/docker-compose")
153
+ (literal "/usr/bin/docker")
154
+ (literal "/opt/homebrew/bin/docker")
155
+ (literal "/opt/homebrew/bin/dockerd")
156
+ (literal "/opt/homebrew/bin/docker-compose")
157
+ (literal "/opt/homebrew/bin/podman")
158
+ (literal "/usr/local/bin/podman")
159
+ (literal "/opt/homebrew/bin/colima")
160
+ (literal "/usr/local/bin/colima")
161
+ (literal "/opt/homebrew/bin/orb")
162
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
163
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
164
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
165
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
166
+ )
167
+
168
+ ;; Block com.docker.* and container manager Mach lookup / XPC services
169
+ (deny mach-lookup
170
+ (xpc-service-name-prefix "com.docker.")
171
+ (global-name-prefix "com.docker.")
172
+ (global-name-prefix "dev.kdrag0n.OrbStack")
173
+ )
174
+
175
+ ;; Block Docker POSIX Shared Memory
176
+ (deny ipc-posix-shm*
177
+ (ipc-posix-name-prefix "docker")
178
+ (ipc-posix-name-prefix "com.docker.")
179
+ )
180
+
package/dist/src/utils/sandbox-macos-strict-proxied.sb CHANGED
@@ -130,3 +130,53 @@
130
130
  ;; set `CELL_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
131
131
  ;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
132
132
  (allow network-outbound (remote tcp "localhost:8877"))
133
+
134
+ ;; Block Docker & container daemon UNIX domain sockets (read & write)
135
+ (deny file-read* file-write*
136
+ (literal "/var/run/docker.sock")
137
+ (literal "/var/run/docker.sock.raw")
138
+ (literal "/private/var/run/docker.sock")
139
+ (literal "/private/var/run/docker.sock.raw")
140
+ (subpath "/var/run/docker")
141
+ (subpath "/private/var/run/docker")
142
+ (subpath "/Users/Shared/.docker")
143
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
144
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
145
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
146
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
147
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
148
+ )
149
+
150
+ ;; Block container CLI and daemon binaries from execution
151
+ (deny process-exec
152
+ (literal "/usr/local/bin/docker")
153
+ (literal "/usr/local/bin/dockerd")
154
+ (literal "/usr/local/bin/docker-compose")
155
+ (literal "/usr/bin/docker")
156
+ (literal "/opt/homebrew/bin/docker")
157
+ (literal "/opt/homebrew/bin/dockerd")
158
+ (literal "/opt/homebrew/bin/docker-compose")
159
+ (literal "/opt/homebrew/bin/podman")
160
+ (literal "/usr/local/bin/podman")
161
+ (literal "/opt/homebrew/bin/colima")
162
+ (literal "/usr/local/bin/colima")
163
+ (literal "/opt/homebrew/bin/orb")
164
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
165
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
166
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
167
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
168
+ )
169
+
170
+ ;; Block com.docker.* and container manager Mach lookup / XPC services
171
+ (deny mach-lookup
172
+ (xpc-service-name-prefix "com.docker.")
173
+ (global-name-prefix "com.docker.")
174
+ (global-name-prefix "dev.kdrag0n.OrbStack")
175
+ )
176
+
177
+ ;; Block Docker POSIX Shared Memory
178
+ (deny ipc-posix-shm*
179
+ (ipc-posix-name-prefix "docker")
180
+ (ipc-posix-name-prefix "com.docker.")
181
+ )
182
+
package/dist/src/utils/sandboxBuiltinProfiles.js CHANGED
@@ -98,7 +98,48 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
98
98
  (allow file-ioctl (regex #"^/dev/tty.*"))
99
99
  (allow network-inbound (local ip "*:*"))
100
100
  (allow network-bind (local ip "*:*"))
101
- (allow network-outbound)`,
101
+ (allow network-outbound)
102
+ (deny file-read* file-write*
103
+ (literal "/var/run/docker.sock")
104
+ (literal "/var/run/docker.sock.raw")
105
+ (literal "/private/var/run/docker.sock")
106
+ (literal "/private/var/run/docker.sock.raw")
107
+ (subpath "/var/run/docker")
108
+ (subpath "/private/var/run/docker")
109
+ (subpath "/Users/Shared/.docker")
110
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
111
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
112
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
113
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
114
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
115
+ )
116
+ (deny process-exec
117
+ (literal "/usr/local/bin/docker")
118
+ (literal "/usr/local/bin/dockerd")
119
+ (literal "/usr/local/bin/docker-compose")
120
+ (literal "/usr/bin/docker")
121
+ (literal "/opt/homebrew/bin/docker")
122
+ (literal "/opt/homebrew/bin/dockerd")
123
+ (literal "/opt/homebrew/bin/docker-compose")
124
+ (literal "/opt/homebrew/bin/podman")
125
+ (literal "/usr/local/bin/podman")
126
+ (literal "/opt/homebrew/bin/colima")
127
+ (literal "/usr/local/bin/colima")
128
+ (literal "/opt/homebrew/bin/orb")
129
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
130
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
131
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
132
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
133
+ )
134
+ (deny mach-lookup
135
+ (xpc-service-name-prefix "com.docker.")
136
+ (global-name-prefix "com.docker.")
137
+ (global-name-prefix "dev.kdrag0n.OrbStack")
138
+ )
139
+ (deny ipc-posix-shm*
140
+ (ipc-posix-name-prefix "docker")
141
+ (ipc-posix-name-prefix "com.docker.")
142
+ )`,
102
143
  'permissive-proxied': `(version 1)
103
144
  (deny default)
104
145
  (allow file-read*)
@@ -193,7 +234,48 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
193
234
  (allow file-ioctl (regex #"^/dev/tty.*"))
194
235
  (allow network-inbound (local ip "localhost:9229"))
195
236
  (allow network-bind (local ip "*:*"))
196
- (allow network-outbound (remote tcp "localhost:8877"))`,
237
+ (allow network-outbound (remote tcp "localhost:8877"))
238
+ (deny file-read* file-write*
239
+ (literal "/var/run/docker.sock")
240
+ (literal "/var/run/docker.sock.raw")
241
+ (literal "/private/var/run/docker.sock")
242
+ (literal "/private/var/run/docker.sock.raw")
243
+ (subpath "/var/run/docker")
244
+ (subpath "/private/var/run/docker")
245
+ (subpath "/Users/Shared/.docker")
246
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
247
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
248
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
249
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
250
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
251
+ )
252
+ (deny process-exec
253
+ (literal "/usr/local/bin/docker")
254
+ (literal "/usr/local/bin/dockerd")
255
+ (literal "/usr/local/bin/docker-compose")
256
+ (literal "/usr/bin/docker")
257
+ (literal "/opt/homebrew/bin/docker")
258
+ (literal "/opt/homebrew/bin/dockerd")
259
+ (literal "/opt/homebrew/bin/docker-compose")
260
+ (literal "/opt/homebrew/bin/podman")
261
+ (literal "/usr/local/bin/podman")
262
+ (literal "/opt/homebrew/bin/colima")
263
+ (literal "/usr/local/bin/colima")
264
+ (literal "/opt/homebrew/bin/orb")
265
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
266
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
267
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
268
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
269
+ )
270
+ (deny mach-lookup
271
+ (xpc-service-name-prefix "com.docker.")
272
+ (global-name-prefix "com.docker.")
273
+ (global-name-prefix "dev.kdrag0n.OrbStack")
274
+ )
275
+ (deny ipc-posix-shm*
276
+ (ipc-posix-name-prefix "docker")
277
+ (ipc-posix-name-prefix "com.docker.")
278
+ )`,
197
279
  'restrictive-open': `(version 1)
198
280
  (deny default)
199
281
  (allow file-read*)
@@ -265,7 +347,48 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
265
347
  (allow mach-lookup (global-name "com.apple.sysmond"))
266
348
  (allow file-ioctl (regex #"^/dev/tty.*"))
267
349
  (allow network-inbound (local ip "localhost:9229"))
268
- (allow network-outbound)`,
350
+ (allow network-outbound)
351
+ (deny file-read* file-write*
352
+ (literal "/var/run/docker.sock")
353
+ (literal "/var/run/docker.sock.raw")
354
+ (literal "/private/var/run/docker.sock")
355
+ (literal "/private/var/run/docker.sock.raw")
356
+ (subpath "/var/run/docker")
357
+ (subpath "/private/var/run/docker")
358
+ (subpath "/Users/Shared/.docker")
359
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
360
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
361
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
362
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
363
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
364
+ )
365
+ (deny process-exec
366
+ (literal "/usr/local/bin/docker")
367
+ (literal "/usr/local/bin/dockerd")
368
+ (literal "/usr/local/bin/docker-compose")
369
+ (literal "/usr/bin/docker")
370
+ (literal "/opt/homebrew/bin/docker")
371
+ (literal "/opt/homebrew/bin/dockerd")
372
+ (literal "/opt/homebrew/bin/docker-compose")
373
+ (literal "/opt/homebrew/bin/podman")
374
+ (literal "/usr/local/bin/podman")
375
+ (literal "/opt/homebrew/bin/colima")
376
+ (literal "/usr/local/bin/colima")
377
+ (literal "/opt/homebrew/bin/orb")
378
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
379
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
380
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
381
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
382
+ )
383
+ (deny mach-lookup
384
+ (xpc-service-name-prefix "com.docker.")
385
+ (global-name-prefix "com.docker.")
386
+ (global-name-prefix "dev.kdrag0n.OrbStack")
387
+ )
388
+ (deny ipc-posix-shm*
389
+ (ipc-posix-name-prefix "docker")
390
+ (ipc-posix-name-prefix "com.docker.")
391
+ )`,
269
392
  'restrictive-proxied': `(version 1)
270
393
  (deny default)
271
394
  (allow file-read*)
@@ -337,7 +460,48 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
337
460
  (allow mach-lookup (global-name "com.apple.sysmond"))
338
461
  (allow file-ioctl (regex #"^/dev/tty.*"))
339
462
  (allow network-inbound (local ip "localhost:9229"))
340
- (allow network-outbound (remote tcp "localhost:8877"))`,
463
+ (allow network-outbound (remote tcp "localhost:8877"))
464
+ (deny file-read* file-write*
465
+ (literal "/var/run/docker.sock")
466
+ (literal "/var/run/docker.sock.raw")
467
+ (literal "/private/var/run/docker.sock")
468
+ (literal "/private/var/run/docker.sock.raw")
469
+ (subpath "/var/run/docker")
470
+ (subpath "/private/var/run/docker")
471
+ (subpath "/Users/Shared/.docker")
472
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
473
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
474
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
475
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
476
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
477
+ )
478
+ (deny process-exec
479
+ (literal "/usr/local/bin/docker")
480
+ (literal "/usr/local/bin/dockerd")
481
+ (literal "/usr/local/bin/docker-compose")
482
+ (literal "/usr/bin/docker")
483
+ (literal "/opt/homebrew/bin/docker")
484
+ (literal "/opt/homebrew/bin/dockerd")
485
+ (literal "/opt/homebrew/bin/docker-compose")
486
+ (literal "/opt/homebrew/bin/podman")
487
+ (literal "/usr/local/bin/podman")
488
+ (literal "/opt/homebrew/bin/colima")
489
+ (literal "/usr/local/bin/colima")
490
+ (literal "/opt/homebrew/bin/orb")
491
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
492
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
493
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
494
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
495
+ )
496
+ (deny mach-lookup
497
+ (xpc-service-name-prefix "com.docker.")
498
+ (global-name-prefix "com.docker.")
499
+ (global-name-prefix "dev.kdrag0n.OrbStack")
500
+ )
501
+ (deny ipc-posix-shm*
502
+ (ipc-posix-name-prefix "docker")
503
+ (ipc-posix-name-prefix "com.docker.")
504
+ )`,
341
505
  'strict-open': `(version 1)
342
506
  (deny default)
343
507
  (allow file-read*
@@ -438,7 +602,48 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
438
602
  (allow mach-lookup (global-name "com.apple.sysmond"))
439
603
  (allow file-ioctl (regex #"^/dev/tty.*"))
440
604
  (allow network-inbound (local ip "localhost:9229"))
441
- (allow network-outbound)`,
605
+ (allow network-outbound)
606
+ (deny file-read* file-write*
607
+ (literal "/var/run/docker.sock")
608
+ (literal "/var/run/docker.sock.raw")
609
+ (literal "/private/var/run/docker.sock")
610
+ (literal "/private/var/run/docker.sock.raw")
611
+ (subpath "/var/run/docker")
612
+ (subpath "/private/var/run/docker")
613
+ (subpath "/Users/Shared/.docker")
614
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
615
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
616
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
617
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
618
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
619
+ )
620
+ (deny process-exec
621
+ (literal "/usr/local/bin/docker")
622
+ (literal "/usr/local/bin/dockerd")
623
+ (literal "/usr/local/bin/docker-compose")
624
+ (literal "/usr/bin/docker")
625
+ (literal "/opt/homebrew/bin/docker")
626
+ (literal "/opt/homebrew/bin/dockerd")
627
+ (literal "/opt/homebrew/bin/docker-compose")
628
+ (literal "/opt/homebrew/bin/podman")
629
+ (literal "/usr/local/bin/podman")
630
+ (literal "/opt/homebrew/bin/colima")
631
+ (literal "/usr/local/bin/colima")
632
+ (literal "/opt/homebrew/bin/orb")
633
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
634
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
635
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
636
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
637
+ )
638
+ (deny mach-lookup
639
+ (xpc-service-name-prefix "com.docker.")
640
+ (global-name-prefix "com.docker.")
641
+ (global-name-prefix "dev.kdrag0n.OrbStack")
642
+ )
643
+ (deny ipc-posix-shm*
644
+ (ipc-posix-name-prefix "docker")
645
+ (ipc-posix-name-prefix "com.docker.")
646
+ )`,
442
647
  'strict-proxied': `(version 1)
443
648
  (deny default)
444
649
  (allow file-read*
@@ -539,7 +744,48 @@ export const BUILTIN_SEATBELT_PROFILE_CONTENTS = {
539
744
  (allow mach-lookup (global-name "com.apple.sysmond"))
540
745
  (allow file-ioctl (regex #"^/dev/tty.*"))
541
746
  (allow network-inbound (local ip "localhost:9229"))
542
- (allow network-outbound (remote tcp "localhost:8877"))`,
747
+ (allow network-outbound (remote tcp "localhost:8877"))
748
+ (deny file-read* file-write*
749
+ (literal "/var/run/docker.sock")
750
+ (literal "/var/run/docker.sock.raw")
751
+ (literal "/private/var/run/docker.sock")
752
+ (literal "/private/var/run/docker.sock.raw")
753
+ (subpath "/var/run/docker")
754
+ (subpath "/private/var/run/docker")
755
+ (subpath "/Users/Shared/.docker")
756
+ (subpath (string-append (param "HOME_DIR") "/.docker/run"))
757
+ (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
758
+ (subpath (string-append (param "HOME_DIR") "/.colima"))
759
+ (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
760
+ (subpath (string-append (param "HOME_DIR") "/.rd"))
761
+ )
762
+ (deny process-exec
763
+ (literal "/usr/local/bin/docker")
764
+ (literal "/usr/local/bin/dockerd")
765
+ (literal "/usr/local/bin/docker-compose")
766
+ (literal "/usr/bin/docker")
767
+ (literal "/opt/homebrew/bin/docker")
768
+ (literal "/opt/homebrew/bin/dockerd")
769
+ (literal "/opt/homebrew/bin/docker-compose")
770
+ (literal "/opt/homebrew/bin/podman")
771
+ (literal "/usr/local/bin/podman")
772
+ (literal "/opt/homebrew/bin/colima")
773
+ (literal "/usr/local/bin/colima")
774
+ (literal "/opt/homebrew/bin/orb")
775
+ (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
776
+ (subpath "/Applications/Docker.app/Contents/MacOS/")
777
+ (subpath "/Applications/OrbStack.app/Contents/MacOS/")
778
+ (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
779
+ )
780
+ (deny mach-lookup
781
+ (xpc-service-name-prefix "com.docker.")
782
+ (global-name-prefix "com.docker.")
783
+ (global-name-prefix "dev.kdrag0n.OrbStack")
784
+ )
785
+ (deny ipc-posix-shm*
786
+ (ipc-posix-name-prefix "docker")
787
+ (ipc-posix-name-prefix "com.docker.")
788
+ )`,
543
789
  };
544
790
  // Map standard 'closed' profiles to their strict counterparts for backward compatibility and fallback support
545
791
  BUILTIN_SEATBELT_PROFILE_CONTENTS['permissive-closed'] =
package/dist/src/utils/sandboxBuiltinProfiles.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"sandboxBuiltinProfiles.js","sourceRoot":"","sources":["../../../src/utils/sandboxBuiltinProfiles.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAA2B;IACvE,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA8FI;IAEvB,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uDA8F+B;IAErD,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAuEG;IAEvB,qBAAqB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uDAuE8B;IAErD,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAoGQ;IAEvB,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uDAoGmC;CACtD,CAAC;AAEF,8GAA8G;AAC9G,iCAAiC,CAAC,mBAAmB,CAAC;IACpD,iCAAiC,CAAC,aAAa,CAAC,CAAC;AACnD,iCAAiC,CAAC,oBAAoB,CAAC;IACrD,iCAAiC,CAAC,gBAAgB,CAAC,CAAC"}
1
+ {"version":3,"file":"sandboxBuiltinProfiles.js","sourceRoot":"","sources":["../../../src/utils/sandboxBuiltinProfiles.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAA2B;IACvE,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuInB;IAEA,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuItB;IAEA,kBAAkB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgHpB;IAEA,qBAAqB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgHvB;IAEA,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6If;IAEA,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6IlB;CACD,CAAC;AAEF,8GAA8G;AAC9G,iCAAiC,CAAC,mBAAmB,CAAC;IACpD,iCAAiC,CAAC,aAAa,CAAC,CAAC;AACnD,iCAAiC,CAAC,oBAAoB,CAAC;IACrD,iCAAiC,CAAC,gBAAgB,CAAC,CAAC"}