Initial commit
This commit is contained in:
@@ -0,0 +1,267 @@
|
||||
use std::fs;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
use crate::SandboxError;
|
||||
|
||||
pub struct PathContext {
|
||||
pub home: String,
|
||||
pub run_user: String,
|
||||
}
|
||||
|
||||
pub struct BlacklistOverlays {
|
||||
pub tmpfs_dirs: Vec<PathBuf>,
|
||||
pub null_bind_files: Vec<PathBuf>,
|
||||
}
|
||||
|
||||
pub fn resolve_overlays(ctx: &PathContext) -> Result<BlacklistOverlays, SandboxError> {
|
||||
let mut tmpfs_dirs = Vec::new();
|
||||
let mut null_bind_files = Vec::new();
|
||||
|
||||
for raw in SENSITIVE_PATHS {
|
||||
let expanded = expand_path(raw, ctx);
|
||||
for path in expand_glob(&expanded)? {
|
||||
match classify_path(&path) {
|
||||
PathKind::Dir => tmpfs_dirs.push(path),
|
||||
PathKind::File => {
|
||||
if !is_under_tmpfs_dir(&path, &tmpfs_dirs) {
|
||||
null_bind_files.push(path);
|
||||
}
|
||||
}
|
||||
PathKind::Missing => {}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Ok(BlacklistOverlays {
|
||||
tmpfs_dirs,
|
||||
null_bind_files,
|
||||
})
|
||||
}
|
||||
|
||||
pub fn resolve_path_context() -> Result<PathContext, SandboxError> {
|
||||
let home = std::env::var("HOME").map_err(|_| SandboxError::HomeNotSet)?;
|
||||
let run_user = std::env::var("XDG_RUNTIME_DIR")
|
||||
.unwrap_or_else(|_| resolve_run_user_from_proc().unwrap_or_else(|| "/run/user/0".into()));
|
||||
Ok(PathContext { home, run_user })
|
||||
}
|
||||
|
||||
enum PathKind {
|
||||
Dir,
|
||||
File,
|
||||
Missing,
|
||||
}
|
||||
|
||||
fn classify_path(path: &Path) -> PathKind {
|
||||
match fs::symlink_metadata(path) {
|
||||
Ok(m) if m.is_dir() => PathKind::Dir,
|
||||
Ok(_) => PathKind::File,
|
||||
Err(_) => PathKind::Missing,
|
||||
}
|
||||
}
|
||||
|
||||
fn expand_path(raw: &str, ctx: &PathContext) -> String {
|
||||
let s = raw
|
||||
.replace("${HOME}", &ctx.home)
|
||||
.replace("${RUNUSER}", &ctx.run_user);
|
||||
let s = if let Some(rest) = s.strip_prefix('~') {
|
||||
format!("{}{rest}", ctx.home)
|
||||
} else {
|
||||
s
|
||||
};
|
||||
assert!(
|
||||
!s.contains("${"),
|
||||
"unexpanded variable in SENSITIVE_PATHS entry: {raw}"
|
||||
);
|
||||
s
|
||||
}
|
||||
|
||||
fn expand_glob(pattern: &str) -> Result<Vec<PathBuf>, SandboxError> {
|
||||
let entries = glob::glob(pattern)?;
|
||||
Ok(entries.filter_map(|r| r.ok()).collect())
|
||||
}
|
||||
|
||||
fn is_under_tmpfs_dir(path: &Path, tmpfs_dirs: &[PathBuf]) -> bool {
|
||||
tmpfs_dirs.iter().any(|dir| path.starts_with(dir))
|
||||
}
|
||||
|
||||
fn resolve_run_user_from_proc() -> Option<String> {
|
||||
let status = fs::read_to_string("/proc/self/status").ok()?;
|
||||
for line in status.lines() {
|
||||
if let Some(rest) = line.strip_prefix("Uid:") {
|
||||
let uid = rest.split_whitespace().next()?;
|
||||
return Some(format!("/run/user/{uid}"));
|
||||
}
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Curated sensitive paths from firejail disable-common.inc + disable-programs.inc.
|
||||
// Goal: protect secrets, credentials, and session tokens from agentic access.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
const SENSITIVE_PATHS: &[&str] = &[
|
||||
// -- history files (can leak passwords/tokens typed on command line) --
|
||||
"${HOME}/.*_history",
|
||||
"${HOME}/.*_history_*",
|
||||
"${HOME}/.histfile",
|
||||
"${HOME}/.history",
|
||||
"${HOME}/.python-history",
|
||||
"${HOME}/.pythonhist",
|
||||
"${HOME}/.viminfo",
|
||||
"${HOME}/.lesshst",
|
||||
// -- clipboard managers (may contain copied passwords) --
|
||||
"${HOME}/.cache/greenclip*",
|
||||
"${HOME}/.kde/share/apps/klipper",
|
||||
"${HOME}/.kde4/share/apps/klipper",
|
||||
"${HOME}/.local/share/klipper",
|
||||
"/tmp/clipmenu*",
|
||||
// -- SSH and remote access --
|
||||
"${HOME}/.ssh",
|
||||
"${HOME}/.rhosts",
|
||||
"${HOME}/.shosts",
|
||||
"/etc/hosts.equiv",
|
||||
"/etc/ssh",
|
||||
"/etc/ssh/*",
|
||||
// -- GPG --
|
||||
"${HOME}/.gnupg",
|
||||
// -- git credentials --
|
||||
"${HOME}/.git-credentials",
|
||||
"${HOME}/.git-credential-cache",
|
||||
"${HOME}/.config/hub",
|
||||
"${HOME}/.config/gh",
|
||||
// -- general credentials and secrets --
|
||||
"${HOME}/.netrc",
|
||||
"${HOME}/.cargo/credentials",
|
||||
"${HOME}/.cargo/credentials.toml",
|
||||
"${HOME}/.fetchmailrc",
|
||||
"${HOME}/.msmtprc",
|
||||
"${HOME}/.smbcredentials",
|
||||
"${HOME}/.davfs2/secrets",
|
||||
"${HOME}/.config/msmtp",
|
||||
"${HOME}/.config/keybase",
|
||||
"${HOME}/.minisign",
|
||||
"${HOME}/.caff",
|
||||
"${HOME}/.password-store",
|
||||
// -- cloud provider credentials --
|
||||
"${HOME}/.aws",
|
||||
"${HOME}/.boto",
|
||||
"${HOME}/.config/gcloud",
|
||||
"${HOME}/.kube",
|
||||
"${HOME}/.passwd-s3fs",
|
||||
"${HOME}/.s3cmd",
|
||||
"/etc/boto.cfg",
|
||||
// -- keyrings and wallets --
|
||||
"${HOME}/.gnome2/keyrings",
|
||||
"${HOME}/.local/share/keyrings",
|
||||
"${HOME}/.local/share/kwalletd",
|
||||
"${HOME}/.kde/share/apps/kwallet",
|
||||
"${HOME}/.kde4/share/apps/kwallet",
|
||||
// -- certificates and PKI --
|
||||
"${HOME}/.pki",
|
||||
"${HOME}/.cert",
|
||||
"${HOME}/.local/share/pki",
|
||||
"${HOME}/.local/share/plasma-vault",
|
||||
"${HOME}/.vaults",
|
||||
// -- KeePass databases --
|
||||
"${HOME}/*.kdb",
|
||||
"${HOME}/*.kdbx",
|
||||
// -- encryption --
|
||||
"${HOME}/.ecryptfs",
|
||||
"${HOME}/.fscrypt",
|
||||
"${HOME}/.Private",
|
||||
"${HOME}/Private",
|
||||
"/.fscrypt",
|
||||
"/home/.ecryptfs",
|
||||
"/home/.fscrypt",
|
||||
"/crypto_keyfile.bin",
|
||||
// -- system auth files --
|
||||
"/etc/shadow",
|
||||
"/etc/shadow+",
|
||||
"/etc/shadow-",
|
||||
"/etc/gshadow",
|
||||
"/etc/gshadow+",
|
||||
"/etc/gshadow-",
|
||||
"/etc/passwd+",
|
||||
"/etc/passwd-",
|
||||
"/etc/group+",
|
||||
"/etc/group-",
|
||||
"/etc/sudo*.conf",
|
||||
"/etc/sudoers*",
|
||||
"/etc/doas.conf",
|
||||
"/etc/davfs2/secrets",
|
||||
"/etc/msmtprc",
|
||||
// -- session directory and sockets (lateral movement vectors) --
|
||||
"/tmp/ssh-*",
|
||||
"/tmp/tmux-*",
|
||||
"${RUNUSER}",
|
||||
"/var/run/docker.sock",
|
||||
// -- mail (sensitive content) --
|
||||
"${HOME}/.Mail",
|
||||
"${HOME}/.mail",
|
||||
"${HOME}/Mail",
|
||||
"${HOME}/mail",
|
||||
"${HOME}/postponed",
|
||||
"${HOME}/sent",
|
||||
"${HOME}/.mutt",
|
||||
"${HOME}/.muttrc",
|
||||
// -- password managers --
|
||||
"${HOME}/.keepass",
|
||||
"${HOME}/.keepassx",
|
||||
"${HOME}/.keepassxc",
|
||||
"${HOME}/.config/KeePass",
|
||||
"${HOME}/.config/KeePassXCrc",
|
||||
"${HOME}/.config/keepassxc",
|
||||
"${HOME}/.cache/keepassxc",
|
||||
"${HOME}/.local/share/KeePass",
|
||||
"${HOME}/.config/1Password",
|
||||
"${HOME}/.config/Bitwarden",
|
||||
"${HOME}/.config/Enpass",
|
||||
"${HOME}/.cache/Enpass",
|
||||
"${HOME}/.local/share/Enpass",
|
||||
"${HOME}/.lastpass",
|
||||
"${HOME}/.config/Authenticator",
|
||||
"${HOME}/.cache/Authenticator",
|
||||
// -- browser profiles (saved passwords, cookies, session tokens) --
|
||||
"${HOME}/.mozilla",
|
||||
"${HOME}/.cache/mozilla",
|
||||
"${HOME}/.config/mozilla",
|
||||
"${HOME}/.config/google-chrome",
|
||||
"${HOME}/.cache/google-chrome",
|
||||
"${HOME}/.config/chromium",
|
||||
"${HOME}/.cache/chromium",
|
||||
"${HOME}/.config/BraveSoftware",
|
||||
"${HOME}/.cache/BraveSoftware",
|
||||
"${HOME}/.config/microsoft-edge",
|
||||
"${HOME}/.cache/microsoft-edge",
|
||||
"${HOME}/.config/vivaldi",
|
||||
"${HOME}/.cache/vivaldi",
|
||||
"${HOME}/.config/opera",
|
||||
"${HOME}/.cache/opera",
|
||||
"${HOME}/.librewolf",
|
||||
"${HOME}/.cache/librewolf",
|
||||
"${HOME}/.config/qutebrowser",
|
||||
"${HOME}/.cache/qutebrowser",
|
||||
"${HOME}/.local/opt/tor-browser",
|
||||
"${HOME}/.tor-browser*",
|
||||
"${HOME}/.cache/torbrowser",
|
||||
"${HOME}/.config/torbrowser",
|
||||
// -- cryptocurrency wallets --
|
||||
"${HOME}/.*coin",
|
||||
"${HOME}/.bitcoin",
|
||||
"${HOME}/.electrum*",
|
||||
"${HOME}/.ethereum",
|
||||
"${HOME}/Monero/wallets",
|
||||
"${HOME}/wallet.dat",
|
||||
// -- nyx (tor controller) --
|
||||
"${HOME}/.nyx",
|
||||
// -- D-Bus sockets (can execute commands via systemd) --
|
||||
"/run/dbus",
|
||||
"/var/run/dbus",
|
||||
// -- X11 / Wayland sockets (keystroke injection, screen capture) --
|
||||
"/tmp/.X11-unix",
|
||||
"/tmp/.ICE-unix",
|
||||
"/tmp/.XIM-unix",
|
||||
"${RUNUSER}/wayland-*",
|
||||
"${RUNUSER}/X11-display",
|
||||
];
|
||||
Reference in New Issue
Block a user