Initial commit
This commit is contained in:
JY Tan
17
.gitignore
vendored
Normal file
17
.gitignore
vendored
Normal file
@@ -0,0 +1,17 @@
|
|||||||
|
# Binary (only at root, not cmd/fence or pkg/fence)
|
||||||
|
/fence
|
||||||
|
|
||||||
|
# OS files
|
||||||
|
.DS_Store
|
||||||
|
Thumbs.db
|
||||||
|
|
||||||
|
# IDE
|
||||||
|
.idea/
|
||||||
|
.vscode/
|
||||||
|
*.swp
|
||||||
|
*.swo
|
||||||
|
|
||||||
|
# Test artifacts
|
||||||
|
*.test
|
||||||
|
coverage.out
|
||||||
|
|
||||||
338
ARCHITECTURE.md
Normal file
338
ARCHITECTURE.md
Normal file
@@ -0,0 +1,338 @@
|
|||||||
|
# Fence Architecture
|
||||||
|
|
||||||
|
Fence restricts network and filesystem access for arbitrary commands. It works by:
|
||||||
|
|
||||||
|
1. **Intercepting network traffic** via HTTP/SOCKS5 proxies that filter by domain
|
||||||
|
2. **Sandboxing processes** using OS-native mechanisms (macOS sandbox-exec, Linux bubblewrap)
|
||||||
|
3. **Bridging connections** to allow controlled inbound/outbound traffic in isolated namespaces
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
flowchart TB
|
||||||
|
subgraph Fence
|
||||||
|
Config["Config<br/>(JSON)"]
|
||||||
|
Manager
|
||||||
|
Sandbox["Platform Sandbox<br/>(macOS/Linux)"]
|
||||||
|
HTTP["HTTP Proxy<br/>(filtering)"]
|
||||||
|
SOCKS["SOCKS5 Proxy<br/>(filtering)"]
|
||||||
|
end
|
||||||
|
|
||||||
|
Config --> Manager
|
||||||
|
Manager --> Sandbox
|
||||||
|
Manager --> HTTP
|
||||||
|
Manager --> SOCKS
|
||||||
|
```
|
||||||
|
|
||||||
|
## Project Structure
|
||||||
|
|
||||||
|
```text
|
||||||
|
fence/
|
||||||
|
├── cmd/fence/ # CLI entry point
|
||||||
|
│ └── main.go
|
||||||
|
├── internal/ # Private implementation
|
||||||
|
│ ├── config/ # Configuration loading/validation
|
||||||
|
│ ├── platform/ # OS detection
|
||||||
|
│ ├── proxy/ # HTTP and SOCKS5 filtering proxies
|
||||||
|
│ └── sandbox/ # Platform-specific sandboxing
|
||||||
|
│ ├── manager.go # Orchestrates sandbox lifecycle
|
||||||
|
│ ├── macos.go # macOS sandbox-exec profiles
|
||||||
|
│ ├── linux.go # Linux bubblewrap + socat bridges
|
||||||
|
│ ├── dangerous.go # Protected file/directory lists
|
||||||
|
│ └── utils.go # Path normalization, shell quoting
|
||||||
|
└── pkg/fence/ # Public Go API
|
||||||
|
└── fence.go
|
||||||
|
```
|
||||||
|
|
||||||
|
## Core Components
|
||||||
|
|
||||||
|
### Config (`internal/config/`)
|
||||||
|
|
||||||
|
Handles loading and validating sandbox configuration:
|
||||||
|
|
||||||
|
```go
|
||||||
|
type Config struct {
|
||||||
|
Network NetworkConfig // Domain allow/deny lists
|
||||||
|
Filesystem FilesystemConfig // Read/write restrictions
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
- Loads from `~/.fence.json` or custom path
|
||||||
|
- Falls back to restrictive defaults (block all network)
|
||||||
|
- Validates paths and normalizes them
|
||||||
|
|
||||||
|
### Platform (`internal/platform/`)
|
||||||
|
|
||||||
|
Simple OS detection:
|
||||||
|
|
||||||
|
```go
|
||||||
|
func Detect() Platform // Returns MacOS, Linux, Windows, or Unknown
|
||||||
|
func IsSupported() bool // True for MacOS and Linux
|
||||||
|
```
|
||||||
|
|
||||||
|
### Proxy (`internal/proxy/`)
|
||||||
|
|
||||||
|
Two proxy servers that filter traffic by domain:
|
||||||
|
|
||||||
|
#### HTTP Proxy (`http.go`)
|
||||||
|
|
||||||
|
- Handles HTTP and HTTPS (via CONNECT tunneling)
|
||||||
|
- Extracts domain from Host header or CONNECT request
|
||||||
|
- Returns 403 for blocked domains
|
||||||
|
- Listens on random available port
|
||||||
|
|
||||||
|
#### SOCKS5 Proxy (`socks.go`)
|
||||||
|
|
||||||
|
- Uses `github.com/things-go/go-socks5`
|
||||||
|
- Handles TCP connections (git, ssh, etc.)
|
||||||
|
- Same domain filtering logic as HTTP proxy
|
||||||
|
- Listens on random available port
|
||||||
|
|
||||||
|
**Domain Matching:**
|
||||||
|
|
||||||
|
- Exact match: `example.com`
|
||||||
|
- Wildcard prefix: `*.example.com` (matches `api.example.com`)
|
||||||
|
- Deny takes precedence over allow
|
||||||
|
|
||||||
|
### Sandbox (`internal/sandbox/`)
|
||||||
|
|
||||||
|
#### Manager (`manager.go`)
|
||||||
|
|
||||||
|
Orchestrates the sandbox lifecycle:
|
||||||
|
|
||||||
|
1. Initializes HTTP and SOCKS proxies
|
||||||
|
2. Sets up platform-specific bridges (Linux)
|
||||||
|
3. Wraps commands with sandbox restrictions
|
||||||
|
4. Handles cleanup on exit
|
||||||
|
|
||||||
|
#### macOS Implementation (`macos.go`)
|
||||||
|
|
||||||
|
Uses Apple's `sandbox-exec` with Seatbelt profiles:
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
flowchart LR
|
||||||
|
subgraph macOS Sandbox
|
||||||
|
CMD["User Command"]
|
||||||
|
SE["sandbox-exec -p profile"]
|
||||||
|
ENV["Environment Variables<br/>HTTP_PROXY, HTTPS_PROXY<br/>ALL_PROXY, GIT_SSH_COMMAND"]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Profile Controls
|
||||||
|
NET["Network: deny except localhost"]
|
||||||
|
FS["Filesystem: read/write rules"]
|
||||||
|
PROC["Process: fork/exec permissions"]
|
||||||
|
end
|
||||||
|
|
||||||
|
CMD --> SE
|
||||||
|
SE --> ENV
|
||||||
|
SE -.-> NET
|
||||||
|
SE -.-> FS
|
||||||
|
SE -.-> PROC
|
||||||
|
```
|
||||||
|
|
||||||
|
Seatbelt profiles are generated dynamically based on config:
|
||||||
|
|
||||||
|
- `(deny default)` - deny all by default
|
||||||
|
- `(allow network-outbound (remote ip "localhost:*"))` - only allow proxy
|
||||||
|
- `(allow file-read* ...)` - selective file access
|
||||||
|
- `(allow process-fork)`, `(allow process-exec)` - allow running programs
|
||||||
|
|
||||||
|
#### Linux Implementation (`linux.go`)
|
||||||
|
|
||||||
|
Uses `bubblewrap` (bwrap) with network namespace isolation:
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
flowchart TB
|
||||||
|
subgraph Host
|
||||||
|
HTTP["HTTP Proxy<br/>:random"]
|
||||||
|
SOCKS["SOCKS Proxy<br/>:random"]
|
||||||
|
HSOCAT["socat<br/>(HTTP bridge)"]
|
||||||
|
SSOCAT["socat<br/>(SOCKS bridge)"]
|
||||||
|
USOCK["Unix Sockets<br/>/tmp/fence-*.sock"]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Sandbox ["Sandbox (bwrap --unshare-net)"]
|
||||||
|
CMD["User Command"]
|
||||||
|
ISOCAT["socat :3128"]
|
||||||
|
ISOCKS["socat :1080"]
|
||||||
|
ENV2["HTTP_PROXY=127.0.0.1:3128"]
|
||||||
|
end
|
||||||
|
|
||||||
|
HTTP <--> HSOCAT
|
||||||
|
SOCKS <--> SSOCAT
|
||||||
|
HSOCAT <--> USOCK
|
||||||
|
SSOCAT <--> USOCK
|
||||||
|
USOCK <-->|bind-mounted| ISOCAT
|
||||||
|
USOCK <-->|bind-mounted| ISOCKS
|
||||||
|
CMD --> ISOCAT
|
||||||
|
CMD --> ISOCKS
|
||||||
|
CMD -.-> ENV2
|
||||||
|
```
|
||||||
|
|
||||||
|
**Why socat bridges?**
|
||||||
|
|
||||||
|
With `--unshare-net`, the sandbox has its own isolated network namespace - it cannot reach the host's network at all. Unix sockets provide filesystem-based IPC that works across namespace boundaries:
|
||||||
|
|
||||||
|
1. Host creates Unix socket, connects to TCP proxy
|
||||||
|
2. Socket file is bind-mounted into sandbox
|
||||||
|
3. Sandbox's socat listens on localhost:3128, forwards to Unix socket
|
||||||
|
4. Traffic flows: `sandbox:3128 → Unix socket → host proxy → internet`
|
||||||
|
|
||||||
|
## Inbound Connections (Reverse Bridge)
|
||||||
|
|
||||||
|
For servers running inside the sandbox that need to accept connections:
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
flowchart TB
|
||||||
|
EXT["External Request"]
|
||||||
|
|
||||||
|
subgraph Host
|
||||||
|
HSOCAT["socat<br/>TCP-LISTEN:8888"]
|
||||||
|
USOCK["Unix Socket<br/>/tmp/fence-rev-8888-*.sock"]
|
||||||
|
end
|
||||||
|
|
||||||
|
subgraph Sandbox
|
||||||
|
ISOCAT["socat<br/>UNIX-LISTEN"]
|
||||||
|
APP["App Server<br/>:8888"]
|
||||||
|
end
|
||||||
|
|
||||||
|
EXT --> HSOCAT
|
||||||
|
HSOCAT -->|UNIX-CONNECT| USOCK
|
||||||
|
USOCK <-->|shared via bind /| ISOCAT
|
||||||
|
ISOCAT --> APP
|
||||||
|
```
|
||||||
|
|
||||||
|
Flow:
|
||||||
|
|
||||||
|
1. Host socat listens on TCP port (e.g., 8888)
|
||||||
|
2. Sandbox socat creates Unix socket, forwards to app
|
||||||
|
3. External request → Host:8888 → Unix socket → Sandbox socat → App:8888
|
||||||
|
|
||||||
|
## Execution Flow
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
flowchart TD
|
||||||
|
A["1. CLI parses arguments"] --> B["2. Load config from ~/.fence.json"]
|
||||||
|
B --> C["3. Create Manager"]
|
||||||
|
C --> D["4. Manager.Initialize()"]
|
||||||
|
|
||||||
|
D --> D1["Start HTTP proxy"]
|
||||||
|
D --> D2["Start SOCKS proxy"]
|
||||||
|
D --> D3["[Linux] Create socat bridges"]
|
||||||
|
D --> D4["[Linux] Create reverse bridges"]
|
||||||
|
|
||||||
|
D1 & D2 & D3 & D4 --> E["5. Manager.WrapCommand()"]
|
||||||
|
|
||||||
|
E --> E1["[macOS] Generate Seatbelt profile"]
|
||||||
|
E --> E2["[Linux] Generate bwrap command"]
|
||||||
|
|
||||||
|
E1 & E2 --> F["6. Execute wrapped command"]
|
||||||
|
F --> G["7. Manager.Cleanup()"]
|
||||||
|
|
||||||
|
G --> G1["Kill socat processes"]
|
||||||
|
G --> G2["Remove Unix sockets"]
|
||||||
|
G --> G3["Stop proxy servers"]
|
||||||
|
```
|
||||||
|
|
||||||
|
## Platform Comparison
|
||||||
|
|
||||||
|
| Feature | macOS | Linux |
|
||||||
|
|---------|-------|-------|
|
||||||
|
| Sandbox mechanism | sandbox-exec (Seatbelt) | bubblewrap (namespaces) |
|
||||||
|
| Network isolation | Syscall filtering | Network namespace |
|
||||||
|
| Proxy routing | Environment variables | socat bridges + env vars |
|
||||||
|
| Filesystem control | Profile rules | Bind mounts |
|
||||||
|
| Inbound connections | Profile rules (`network-bind`) | Reverse socat bridges |
|
||||||
|
| Requirements | Built-in | bwrap, socat |
|
||||||
|
|
||||||
|
## Security Model
|
||||||
|
|
||||||
|
### How Each Layer Works
|
||||||
|
|
||||||
|
#### Network Isolation
|
||||||
|
|
||||||
|
All outbound connections are routed through local HTTP/SOCKS5 proxies that filter by domain:
|
||||||
|
|
||||||
|
- Direct socket connections are blocked at the OS level (syscall filtering on macOS, network namespace on Linux)
|
||||||
|
- Only localhost connections to the proxy ports are allowed
|
||||||
|
- The proxy inspects the target domain and allows/denies based on config
|
||||||
|
- Environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`) route application traffic
|
||||||
|
|
||||||
|
#### Filesystem Restrictions
|
||||||
|
|
||||||
|
Access control follows a deny-by-default model for writes:
|
||||||
|
|
||||||
|
| Operation | Default | Config |
|
||||||
|
|-----------|---------|--------|
|
||||||
|
| Read | Allow all | `denyRead` blocks specific paths |
|
||||||
|
| Write | Deny all | `allowWrite` permits specific paths |
|
||||||
|
| Write exceptions | - | `denyWrite` overrides `allowWrite` |
|
||||||
|
|
||||||
|
#### Dangerous File Protection
|
||||||
|
|
||||||
|
Certain paths are always protected regardless of config to prevent common attack vectors:
|
||||||
|
|
||||||
|
- Shell configs: `.bashrc`, `.zshrc`, `.profile`, `.bash_profile`
|
||||||
|
- Git hooks: `.git/hooks/*` (can execute arbitrary code on git operations)
|
||||||
|
- Git config: `.gitconfig`, `.git/config` (can define aliases that run code)
|
||||||
|
- SSH config: `.ssh/config`, `.ssh/authorized_keys`
|
||||||
|
- Editor configs that can execute code: `.vimrc`, `.emacs`
|
||||||
|
|
||||||
|
#### Process Isolation
|
||||||
|
|
||||||
|
- Commands run in isolated namespaces (Linux) or with syscall restrictions (macOS)
|
||||||
|
- PID namespace isolation prevents seeing/signaling host processes (Linux)
|
||||||
|
- New session prevents terminal control attacks
|
||||||
|
|
||||||
|
### What Fence Blocks
|
||||||
|
|
||||||
|
| Attack Vector | How It's Blocked |
|
||||||
|
|---------------|------------------|
|
||||||
|
| Arbitrary network access | Proxy filtering + OS-level enforcement |
|
||||||
|
| Data exfiltration to unknown hosts | Only allowlisted domains reachable |
|
||||||
|
| Writing malicious git hooks | `.git/hooks` always protected |
|
||||||
|
| Modifying shell startup files | `.bashrc`, `.zshrc`, etc. always protected |
|
||||||
|
| Reading sensitive paths | Configurable via `denyRead` |
|
||||||
|
| Arbitrary filesystem writes | Only `allowWrite` paths permitted |
|
||||||
|
|
||||||
|
### What Fence Allows
|
||||||
|
|
||||||
|
- Network access to explicitly allowed domains
|
||||||
|
- Filesystem reads (except `denyRead` paths)
|
||||||
|
- Filesystem writes to `allowWrite` paths
|
||||||
|
- Process spawning within the sandbox
|
||||||
|
- Inbound connections on exposed ports (`-p` flag)
|
||||||
|
|
||||||
|
### Limitations
|
||||||
|
|
||||||
|
#### Domain-based filtering only
|
||||||
|
|
||||||
|
Fence doesn't inspect request content. A sandboxed process can:
|
||||||
|
|
||||||
|
- Download arbitrary code from allowed domains
|
||||||
|
- Exfiltrate data by encoding it in requests to allowed domains
|
||||||
|
- Use allowed domains as tunnels if they support it
|
||||||
|
|
||||||
|
You're trusting your allowlist - if you allow `*.github.com`, the sandbox can reach any GitHub-hosted content.
|
||||||
|
|
||||||
|
#### Root processes may escape restrictions
|
||||||
|
|
||||||
|
- *Linux*: The sandboxed process has root inside its namespace and could potentially manipulate mounts, cgroups, or exploit kernel vulnerabilities. Network namespace isolation (`--unshare-net`) is solid, but filesystem isolation via bind mounts is more permeable.
|
||||||
|
- *macOS*: `sandbox-exec` is robust at the kernel level, but root can modify system state before the sandbox starts or (on older macOS) load kernel extensions.
|
||||||
|
|
||||||
|
#### macOS sandbox-exec is deprecated
|
||||||
|
|
||||||
|
Apple deprecated `sandbox-exec` but it still works on current macOS (including Sequoia). There's no good alternative for CLI sandboxing:
|
||||||
|
|
||||||
|
- App Sandbox requires signed `.app` bundles
|
||||||
|
- Virtualization.framework is heavyweight
|
||||||
|
- We use `sandbox-exec` pragmatically until Apple removes it
|
||||||
|
|
||||||
|
#### Not for hostile code containment
|
||||||
|
|
||||||
|
Fence is defense-in-depth for running semi-trusted code (npm install, build scripts, CI jobs), not a security boundary against actively malicious software designed to escape sandboxes.
|
||||||
|
|
||||||
|
## Dependencies
|
||||||
|
|
||||||
|
- `github.com/spf13/cobra` - CLI framework
|
||||||
|
- `github.com/things-go/go-socks5` - SOCKS5 proxy implementation
|
||||||
|
- `bubblewrap` (Linux) - Unprivileged sandboxing
|
||||||
|
- `socat` (Linux) - Socket relay for namespace bridging
|
||||||
194
README.md
Normal file
194
README.md
Normal file
@@ -0,0 +1,194 @@
|
|||||||
|
# fence
|
||||||
|
|
||||||
|
A Go implementation of process sandboxing with network and filesystem restrictions.
|
||||||
|
|
||||||
|
`fence` wraps arbitrary commands in a security sandbox, blocking network access by default and restricting filesystem operations based on configurable rules.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> This is still a work in progress and may see significant changes.
|
||||||
|
|
||||||
|
## Features
|
||||||
|
|
||||||
|
- **Network Isolation**: All network access blocked by default
|
||||||
|
- **Domain Allowlisting**: Configure which domains are allowed
|
||||||
|
- **Filesystem Restrictions**: Control read/write access to paths
|
||||||
|
- **Cross-Platform**: macOS (sandbox-exec) and Linux (bubblewrap)
|
||||||
|
- **HTTP/SOCKS5 Proxies**: Built-in filtering proxies for domain control
|
||||||
|
- **Library + CLI**: Use as a Go package or command-line tool
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
|
||||||
|
```bash
|
||||||
|
go install github.com/Use-Tusk/fence/cmd/fence@latest
|
||||||
|
```
|
||||||
|
|
||||||
|
Or build from source:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone https://github.com/Use-Tusk/fence
|
||||||
|
cd fence
|
||||||
|
go build -o fence ./cmd/fence
|
||||||
|
```
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# This will be blocked (no domains allowed by default)
|
||||||
|
fence curl https://example.com
|
||||||
|
|
||||||
|
# Run with shell expansion
|
||||||
|
fence -c "echo hello && ls"
|
||||||
|
|
||||||
|
# Enable debug logging
|
||||||
|
fence -d curl https://example.com
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
Create `~/.fence.json` to configure allowed domains and filesystem access:
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"network": {
|
||||||
|
"allowedDomains": ["github.com", "*.npmjs.org", "registry.yarnpkg.com"],
|
||||||
|
"deniedDomains": ["evil.com"]
|
||||||
|
},
|
||||||
|
"filesystem": {
|
||||||
|
"denyRead": ["/etc/passwd"],
|
||||||
|
"allowWrite": [".", "/tmp"],
|
||||||
|
"denyWrite": [".git/hooks"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
### Network Configuration
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
|-------|-------------|
|
||||||
|
| `allowedDomains` | List of allowed domains. Supports wildcards like `*.example.com` |
|
||||||
|
| `deniedDomains` | List of denied domains (checked before allowed) |
|
||||||
|
| `allowUnixSockets` | List of allowed Unix socket paths (macOS) |
|
||||||
|
| `allowAllUnixSockets` | Allow all Unix sockets |
|
||||||
|
| `allowLocalBinding` | Allow binding to local ports |
|
||||||
|
|
||||||
|
### Filesystem Configuration
|
||||||
|
|
||||||
|
| Field | Description |
|
||||||
|
|-------|-------------|
|
||||||
|
| `denyRead` | Paths to deny reading (deny-only pattern) |
|
||||||
|
| `allowWrite` | Paths to allow writing |
|
||||||
|
| `denyWrite` | Paths to deny writing (takes precedence) |
|
||||||
|
| `allowGitConfig` | Allow writes to `.git/config` files |
|
||||||
|
|
||||||
|
## CLI Usage
|
||||||
|
|
||||||
|
```text
|
||||||
|
fence [flags] [command...]
|
||||||
|
|
||||||
|
Flags:
|
||||||
|
-c string Run command string directly (like sh -c)
|
||||||
|
-d, --debug Enable debug logging
|
||||||
|
-s, --settings Path to settings file (default: ~/.fence.json)
|
||||||
|
-h, --help Help for fence
|
||||||
|
```
|
||||||
|
|
||||||
|
### Examples
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Block all network (default behavior)
|
||||||
|
fence curl https://example.com
|
||||||
|
# Output: curl: (7) Couldn't connect to server
|
||||||
|
|
||||||
|
# Use a custom config
|
||||||
|
fence --settings ./my-config.json npm install
|
||||||
|
|
||||||
|
# Run a shell command
|
||||||
|
fence -c "git clone https://github.com/user/repo && cd repo && npm install"
|
||||||
|
|
||||||
|
# Debug mode shows proxy activity
|
||||||
|
fence -d wget https://example.com
|
||||||
|
```
|
||||||
|
|
||||||
|
## Library Usage
|
||||||
|
|
||||||
|
```go
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"github.com/Use-Tusk/fence/pkg/fence"
|
||||||
|
)
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
// Create config
|
||||||
|
cfg := &fence.Config{
|
||||||
|
Network: fence.NetworkConfig{
|
||||||
|
AllowedDomains: []string{"api.example.com"},
|
||||||
|
},
|
||||||
|
Filesystem: fence.FilesystemConfig{
|
||||||
|
AllowWrite: []string{"."},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
// Create manager
|
||||||
|
manager := fence.NewManager(cfg, false)
|
||||||
|
defer manager.Cleanup()
|
||||||
|
|
||||||
|
// Initialize (starts proxies)
|
||||||
|
if err := manager.Initialize(); err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Wrap a command
|
||||||
|
wrapped, err := manager.WrapCommand("curl https://api.example.com/data")
|
||||||
|
if err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
fmt.Println("Sandboxed command:", wrapped)
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## How It Works
|
||||||
|
|
||||||
|
### macOS (sandbox-exec)
|
||||||
|
|
||||||
|
On macOS, fence uses Apple's `sandbox-exec` with a generated seatbelt profile that:
|
||||||
|
|
||||||
|
- Denies all operations by default
|
||||||
|
- Allows specific Mach services needed for basic operation
|
||||||
|
- Controls network access via localhost proxies
|
||||||
|
- Restricts filesystem read/write based on configuration
|
||||||
|
|
||||||
|
### Linux (bubblewrap)
|
||||||
|
|
||||||
|
On Linux, fence uses `bubblewrap` (bwrap) with:
|
||||||
|
|
||||||
|
- Network namespace isolation (`--unshare-net`)
|
||||||
|
- Filesystem bind mounts for access control
|
||||||
|
- PID namespace isolation
|
||||||
|
- Unix socket bridges for proxy communication
|
||||||
|
|
||||||
|
For detailed security model, limitations, and architecture, see [ARCHITECTURE.md](ARCHITECTURE.md).
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
### macOS
|
||||||
|
|
||||||
|
- macOS 10.12+ (uses `sandbox-exec`)
|
||||||
|
- No additional dependencies
|
||||||
|
|
||||||
|
### Linux
|
||||||
|
|
||||||
|
- `bubblewrap` (bwrap)
|
||||||
|
- `socat` (for network bridging)
|
||||||
|
|
||||||
|
Install on Ubuntu/Debian:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
apt install bubblewrap socat
|
||||||
|
```
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
Apache-2.0
|
||||||
163
cmd/fence/main.go
Normal file
163
cmd/fence/main.go
Normal file
@@ -0,0 +1,163 @@
|
|||||||
|
// Package main implements the fence CLI.
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"os/exec"
|
||||||
|
"os/signal"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
"syscall"
|
||||||
|
|
||||||
|
"github.com/Use-Tusk/fence/internal/config"
|
||||||
|
"github.com/Use-Tusk/fence/internal/sandbox"
|
||||||
|
"github.com/spf13/cobra"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
debug bool
|
||||||
|
settingsPath string
|
||||||
|
cmdString string
|
||||||
|
exposePorts []string
|
||||||
|
exitCode int
|
||||||
|
)
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
rootCmd := &cobra.Command{
|
||||||
|
Use: "fence [flags] -- [command...]",
|
||||||
|
Short: "Run commands in a sandbox with network and filesystem restrictions",
|
||||||
|
Long: `fence is a command-line tool that runs commands in a sandboxed environment
|
||||||
|
with network and filesystem restrictions.
|
||||||
|
|
||||||
|
By default, all network access is blocked. Configure allowed domains in
|
||||||
|
~/.fence.json or pass a settings file with --settings.
|
||||||
|
|
||||||
|
Examples:
|
||||||
|
fence curl https://example.com # Will be blocked (no domains allowed)
|
||||||
|
fence -- curl -s https://example.com # Use -- to separate fence flags from command
|
||||||
|
fence -c "echo hello && ls" # Run with shell expansion
|
||||||
|
fence --settings config.json npm install
|
||||||
|
fence -p 3000 -c "npm run dev" # Expose port 3000 for inbound connections
|
||||||
|
fence -p 3000 -p 8080 -c "npm start" # Expose multiple ports
|
||||||
|
|
||||||
|
Configuration file format (~/.fence.json):
|
||||||
|
{
|
||||||
|
"network": {
|
||||||
|
"allowedDomains": ["github.com", "*.npmjs.org"],
|
||||||
|
"deniedDomains": []
|
||||||
|
},
|
||||||
|
"filesystem": {
|
||||||
|
"denyRead": [],
|
||||||
|
"allowWrite": ["."],
|
||||||
|
"denyWrite": []
|
||||||
|
}
|
||||||
|
}`,
|
||||||
|
RunE: runCommand,
|
||||||
|
SilenceUsage: true,
|
||||||
|
SilenceErrors: true,
|
||||||
|
Args: cobra.ArbitraryArgs,
|
||||||
|
}
|
||||||
|
|
||||||
|
rootCmd.Flags().BoolVarP(&debug, "debug", "d", false, "Enable debug logging")
|
||||||
|
rootCmd.Flags().StringVarP(&settingsPath, "settings", "s", "", "Path to settings file (default: ~/.fence.json)")
|
||||||
|
rootCmd.Flags().StringVarP(&cmdString, "c", "c", "", "Run command string directly (like sh -c)")
|
||||||
|
rootCmd.Flags().StringArrayVarP(&exposePorts, "port", "p", nil, "Expose port for inbound connections (can be used multiple times)")
|
||||||
|
|
||||||
|
rootCmd.Flags().SetInterspersed(true)
|
||||||
|
|
||||||
|
if err := rootCmd.Execute(); err != nil {
|
||||||
|
fmt.Fprintf(os.Stderr, "Error: %v\n", err)
|
||||||
|
exitCode = 1
|
||||||
|
}
|
||||||
|
os.Exit(exitCode)
|
||||||
|
}
|
||||||
|
|
||||||
|
func runCommand(cmd *cobra.Command, args []string) error {
|
||||||
|
var command string
|
||||||
|
if cmdString != "" {
|
||||||
|
command = cmdString
|
||||||
|
} else if len(args) > 0 {
|
||||||
|
command = strings.Join(args, " ")
|
||||||
|
} else {
|
||||||
|
return fmt.Errorf("no command specified. Use -c <command> or provide command arguments")
|
||||||
|
}
|
||||||
|
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence] Command: %s\n", command)
|
||||||
|
}
|
||||||
|
|
||||||
|
var ports []int
|
||||||
|
for _, p := range exposePorts {
|
||||||
|
port, err := strconv.Atoi(p)
|
||||||
|
if err != nil || port < 1 || port > 65535 {
|
||||||
|
return fmt.Errorf("invalid port: %s", p)
|
||||||
|
}
|
||||||
|
ports = append(ports, port)
|
||||||
|
}
|
||||||
|
|
||||||
|
if debug && len(ports) > 0 {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence] Exposing ports: %v\n", ports)
|
||||||
|
}
|
||||||
|
|
||||||
|
configPath := settingsPath
|
||||||
|
if configPath == "" {
|
||||||
|
configPath = config.DefaultConfigPath()
|
||||||
|
}
|
||||||
|
|
||||||
|
cfg, err := config.Load(configPath)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("failed to load config: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if cfg == nil {
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence] No config found at %s, using default (block all network)\n", configPath)
|
||||||
|
}
|
||||||
|
cfg = config.Default()
|
||||||
|
}
|
||||||
|
|
||||||
|
manager := sandbox.NewManager(cfg, debug)
|
||||||
|
manager.SetExposedPorts(ports)
|
||||||
|
defer manager.Cleanup()
|
||||||
|
|
||||||
|
if err := manager.Initialize(); err != nil {
|
||||||
|
return fmt.Errorf("failed to initialize sandbox: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
sandboxedCommand, err := manager.WrapCommand(command)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("failed to wrap command: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence] Sandboxed command: %s\n", sandboxedCommand)
|
||||||
|
}
|
||||||
|
|
||||||
|
execCmd := exec.Command("sh", "-c", sandboxedCommand)
|
||||||
|
execCmd.Stdin = os.Stdin
|
||||||
|
execCmd.Stdout = os.Stdout
|
||||||
|
execCmd.Stderr = os.Stderr
|
||||||
|
|
||||||
|
sigChan := make(chan os.Signal, 1)
|
||||||
|
signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
|
||||||
|
|
||||||
|
go func() {
|
||||||
|
sig := <-sigChan
|
||||||
|
if execCmd.Process != nil {
|
||||||
|
execCmd.Process.Signal(sig)
|
||||||
|
}
|
||||||
|
// Give child time to exit, then cleanup will happen via defer
|
||||||
|
}()
|
||||||
|
|
||||||
|
if err := execCmd.Run(); err != nil {
|
||||||
|
if exitErr, ok := err.(*exec.ExitError); ok {
|
||||||
|
// Set exit code but don't os.Exit() here - let deferred cleanup run
|
||||||
|
exitCode = exitErr.ExitCode()
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return fmt.Errorf("command failed: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
13
go.mod
Normal file
13
go.mod
Normal file
@@ -0,0 +1,13 @@
|
|||||||
|
module github.com/Use-Tusk/fence
|
||||||
|
|
||||||
|
go 1.25
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/spf13/cobra v1.8.1
|
||||||
|
github.com/things-go/go-socks5 v0.0.5
|
||||||
|
)
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
||||||
|
github.com/spf13/pflag v1.0.5 // indirect
|
||||||
|
)
|
||||||
21
go.sum
Normal file
21
go.sum
Normal file
@@ -0,0 +1,21 @@
|
|||||||
|
github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
|
||||||
|
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||||
|
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||||
|
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
|
||||||
|
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||||
|
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||||
|
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
|
||||||
|
github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
|
||||||
|
github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
|
||||||
|
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
|
||||||
|
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
|
||||||
|
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
|
||||||
|
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
|
||||||
|
github.com/things-go/go-socks5 v0.0.5 h1:qvKaGcBkfDrUL33SchHN93srAmYGzb4CxSM2DPYufe8=
|
||||||
|
github.com/things-go/go-socks5 v0.0.5/go.mod h1:mtzInf8v5xmsBpHZVbIw2YQYhc4K0jRwzfsH64Uh0IQ=
|
||||||
|
golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
|
||||||
|
golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
|
||||||
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||||
|
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||||
173
internal/config/config.go
Normal file
173
internal/config/config.go
Normal file
@@ -0,0 +1,173 @@
|
|||||||
|
// Package config defines the configuration types and loading for fence.
|
||||||
|
package config
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"slices"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Config is the main configuration for fence.
|
||||||
|
type Config struct {
|
||||||
|
Network NetworkConfig `json:"network"`
|
||||||
|
Filesystem FilesystemConfig `json:"filesystem"`
|
||||||
|
AllowPty bool `json:"allowPty,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// NetworkConfig defines network restrictions.
|
||||||
|
type NetworkConfig struct {
|
||||||
|
AllowedDomains []string `json:"allowedDomains"`
|
||||||
|
DeniedDomains []string `json:"deniedDomains"`
|
||||||
|
AllowUnixSockets []string `json:"allowUnixSockets,omitempty"`
|
||||||
|
AllowAllUnixSockets bool `json:"allowAllUnixSockets,omitempty"`
|
||||||
|
AllowLocalBinding bool `json:"allowLocalBinding,omitempty"`
|
||||||
|
HTTPProxyPort int `json:"httpProxyPort,omitempty"`
|
||||||
|
SOCKSProxyPort int `json:"socksProxyPort,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// FilesystemConfig defines filesystem restrictions.
|
||||||
|
type FilesystemConfig struct {
|
||||||
|
DenyRead []string `json:"denyRead"`
|
||||||
|
AllowWrite []string `json:"allowWrite"`
|
||||||
|
DenyWrite []string `json:"denyWrite"`
|
||||||
|
AllowGitConfig bool `json:"allowGitConfig,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// Default returns the default configuration with all network blocked.
|
||||||
|
func Default() *Config {
|
||||||
|
return &Config{
|
||||||
|
Network: NetworkConfig{
|
||||||
|
AllowedDomains: []string{},
|
||||||
|
DeniedDomains: []string{},
|
||||||
|
},
|
||||||
|
Filesystem: FilesystemConfig{
|
||||||
|
DenyRead: []string{},
|
||||||
|
AllowWrite: []string{},
|
||||||
|
DenyWrite: []string{},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultConfigPath returns the default config file path.
|
||||||
|
func DefaultConfigPath() string {
|
||||||
|
home, err := os.UserHomeDir()
|
||||||
|
if err != nil {
|
||||||
|
return ".fence.json"
|
||||||
|
}
|
||||||
|
return filepath.Join(home, ".fence.json")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Load loads configuration from a file path.
|
||||||
|
func Load(path string) (*Config, error) {
|
||||||
|
data, err := os.ReadFile(path)
|
||||||
|
if err != nil {
|
||||||
|
if os.IsNotExist(err) {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
return nil, fmt.Errorf("failed to read config file: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Handle empty file
|
||||||
|
if len(strings.TrimSpace(string(data))) == 0 {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
var cfg Config
|
||||||
|
if err := json.Unmarshal(data, &cfg); err != nil {
|
||||||
|
return nil, fmt.Errorf("invalid JSON in config file: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := cfg.Validate(); err != nil {
|
||||||
|
return nil, fmt.Errorf("invalid configuration: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return &cfg, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Validate validates the configuration.
|
||||||
|
func (c *Config) Validate() error {
|
||||||
|
for _, domain := range c.Network.AllowedDomains {
|
||||||
|
if err := validateDomainPattern(domain); err != nil {
|
||||||
|
return fmt.Errorf("invalid allowed domain %q: %w", domain, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, domain := range c.Network.DeniedDomains {
|
||||||
|
if err := validateDomainPattern(domain); err != nil {
|
||||||
|
return fmt.Errorf("invalid denied domain %q: %w", domain, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if slices.Contains(c.Filesystem.DenyRead, "") {
|
||||||
|
return errors.New("filesystem.denyRead contains empty path")
|
||||||
|
}
|
||||||
|
if slices.Contains(c.Filesystem.AllowWrite, "") {
|
||||||
|
return errors.New("filesystem.allowWrite contains empty path")
|
||||||
|
}
|
||||||
|
if slices.Contains(c.Filesystem.DenyWrite, "") {
|
||||||
|
return errors.New("filesystem.denyWrite contains empty path")
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func validateDomainPattern(pattern string) error {
|
||||||
|
if pattern == "localhost" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if strings.Contains(pattern, "://") || strings.Contains(pattern, "/") || strings.Contains(pattern, ":") {
|
||||||
|
return errors.New("domain pattern cannot contain protocol, path, or port")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Handle wildcard patterns
|
||||||
|
if strings.HasPrefix(pattern, "*.") {
|
||||||
|
domain := pattern[2:]
|
||||||
|
// Must have at least one more dot after the wildcard
|
||||||
|
if !strings.Contains(domain, ".") {
|
||||||
|
return errors.New("wildcard pattern too broad (e.g., *.com not allowed)")
|
||||||
|
}
|
||||||
|
if strings.HasPrefix(domain, ".") || strings.HasSuffix(domain, ".") {
|
||||||
|
return errors.New("invalid domain format")
|
||||||
|
}
|
||||||
|
// Check each part has content
|
||||||
|
parts := strings.Split(domain, ".")
|
||||||
|
if len(parts) < 2 {
|
||||||
|
return errors.New("wildcard pattern too broad")
|
||||||
|
}
|
||||||
|
if slices.Contains(parts, "") {
|
||||||
|
return errors.New("invalid domain format")
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Reject other uses of wildcards
|
||||||
|
if strings.Contains(pattern, "*") {
|
||||||
|
return errors.New("only *.domain.com wildcard patterns are allowed")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Regular domains must have at least one dot
|
||||||
|
if !strings.Contains(pattern, ".") || strings.HasPrefix(pattern, ".") || strings.HasSuffix(pattern, ".") {
|
||||||
|
return errors.New("invalid domain format")
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// MatchesDomain checks if a hostname matches a domain pattern.
|
||||||
|
func MatchesDomain(hostname, pattern string) bool {
|
||||||
|
hostname = strings.ToLower(hostname)
|
||||||
|
pattern = strings.ToLower(pattern)
|
||||||
|
|
||||||
|
// Wildcard pattern like *.example.com
|
||||||
|
if strings.HasPrefix(pattern, "*.") {
|
||||||
|
baseDomain := pattern[2:]
|
||||||
|
return strings.HasSuffix(hostname, "."+baseDomain)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Exact match
|
||||||
|
return hostname == pattern
|
||||||
|
}
|
||||||
34
internal/platform/platform.go
Normal file
34
internal/platform/platform.go
Normal file
@@ -0,0 +1,34 @@
|
|||||||
|
// Package platform provides OS detection utilities.
|
||||||
|
package platform
|
||||||
|
|
||||||
|
import "runtime"
|
||||||
|
|
||||||
|
// Type represents the detected platform.
|
||||||
|
type Type string
|
||||||
|
|
||||||
|
const (
|
||||||
|
MacOS Type = "macos"
|
||||||
|
Linux Type = "linux"
|
||||||
|
Windows Type = "windows"
|
||||||
|
Unknown Type = "unknown"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Detect returns the current platform type.
|
||||||
|
func Detect() Type {
|
||||||
|
switch runtime.GOOS {
|
||||||
|
case "darwin":
|
||||||
|
return MacOS
|
||||||
|
case "linux":
|
||||||
|
return Linux
|
||||||
|
case "windows":
|
||||||
|
return Windows
|
||||||
|
default:
|
||||||
|
return Unknown
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// IsSupported returns true if the platform supports sandboxing.
|
||||||
|
func IsSupported() bool {
|
||||||
|
p := Detect()
|
||||||
|
return p == MacOS || p == Linux
|
||||||
|
}
|
||||||
278
internal/proxy/http.go
Normal file
278
internal/proxy/http.go
Normal file
@@ -0,0 +1,278 @@
|
|||||||
|
// Package proxy provides HTTP and SOCKS5 proxy servers with domain filtering.
|
||||||
|
package proxy
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/Use-Tusk/fence/internal/config"
|
||||||
|
)
|
||||||
|
|
||||||
|
// FilterFunc determines if a connection to host:port should be allowed.
|
||||||
|
type FilterFunc func(host string, port int) bool
|
||||||
|
|
||||||
|
// HTTPProxy is an HTTP/HTTPS proxy server with domain filtering.
|
||||||
|
type HTTPProxy struct {
|
||||||
|
server *http.Server
|
||||||
|
listener net.Listener
|
||||||
|
filter FilterFunc
|
||||||
|
debug bool
|
||||||
|
mu sync.RWMutex
|
||||||
|
running bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewHTTPProxy creates a new HTTP proxy with the given filter.
|
||||||
|
func NewHTTPProxy(filter FilterFunc, debug bool) *HTTPProxy {
|
||||||
|
return &HTTPProxy{
|
||||||
|
filter: filter,
|
||||||
|
debug: debug,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Start starts the HTTP proxy on a random available port.
|
||||||
|
func (p *HTTPProxy) Start() (int, error) {
|
||||||
|
listener, err := net.Listen("tcp", "127.0.0.1:0")
|
||||||
|
if err != nil {
|
||||||
|
return 0, fmt.Errorf("failed to listen: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
p.listener = listener
|
||||||
|
p.server = &http.Server{
|
||||||
|
Handler: http.HandlerFunc(p.handleRequest),
|
||||||
|
}
|
||||||
|
|
||||||
|
p.mu.Lock()
|
||||||
|
p.running = true
|
||||||
|
p.mu.Unlock()
|
||||||
|
|
||||||
|
go func() {
|
||||||
|
if err := p.server.Serve(listener); err != nil && err != http.ErrServerClosed {
|
||||||
|
p.logDebug("HTTP proxy server error: %v", err)
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
|
||||||
|
addr := listener.Addr().(*net.TCPAddr)
|
||||||
|
p.logDebug("HTTP proxy listening on localhost:%d", addr.Port)
|
||||||
|
return addr.Port, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Stop stops the HTTP proxy.
|
||||||
|
func (p *HTTPProxy) Stop() error {
|
||||||
|
p.mu.Lock()
|
||||||
|
p.running = false
|
||||||
|
p.mu.Unlock()
|
||||||
|
|
||||||
|
if p.server != nil {
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||||
|
defer cancel()
|
||||||
|
return p.server.Shutdown(ctx)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Port returns the port the proxy is listening on.
|
||||||
|
func (p *HTTPProxy) Port() int {
|
||||||
|
if p.listener == nil {
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
return p.listener.Addr().(*net.TCPAddr).Port
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *HTTPProxy) handleRequest(w http.ResponseWriter, r *http.Request) {
|
||||||
|
if r.Method == http.MethodConnect {
|
||||||
|
p.handleConnect(w, r)
|
||||||
|
} else {
|
||||||
|
p.handleHTTP(w, r)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// handleConnect handles HTTPS CONNECT requests (tunnel).
|
||||||
|
func (p *HTTPProxy) handleConnect(w http.ResponseWriter, r *http.Request) {
|
||||||
|
host, portStr, err := net.SplitHostPort(r.Host)
|
||||||
|
if err != nil {
|
||||||
|
host = r.Host
|
||||||
|
portStr = "443"
|
||||||
|
}
|
||||||
|
|
||||||
|
port := 443
|
||||||
|
if portStr != "" {
|
||||||
|
fmt.Sscanf(portStr, "%d", &port)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check if allowed
|
||||||
|
if !p.filter(host, port) {
|
||||||
|
p.logDebug("CONNECT blocked: %s:%d", host, port)
|
||||||
|
http.Error(w, "Connection blocked by network allowlist", http.StatusForbidden)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// Connect to target
|
||||||
|
targetConn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, port), 10*time.Second)
|
||||||
|
if err != nil {
|
||||||
|
p.logDebug("CONNECT dial failed: %s:%d: %v", host, port, err)
|
||||||
|
http.Error(w, "Bad Gateway", http.StatusBadGateway)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
defer targetConn.Close()
|
||||||
|
|
||||||
|
// Hijack the connection
|
||||||
|
hijacker, ok := w.(http.Hijacker)
|
||||||
|
if !ok {
|
||||||
|
http.Error(w, "Hijacking not supported", http.StatusInternalServerError)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
clientConn, _, err := hijacker.Hijack()
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, "Failed to hijack connection", http.StatusInternalServerError)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
defer clientConn.Close()
|
||||||
|
|
||||||
|
clientConn.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n"))
|
||||||
|
|
||||||
|
// Pipe data bidirectionally
|
||||||
|
var wg sync.WaitGroup
|
||||||
|
wg.Add(2)
|
||||||
|
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
io.Copy(targetConn, clientConn)
|
||||||
|
}()
|
||||||
|
|
||||||
|
go func() {
|
||||||
|
defer wg.Done()
|
||||||
|
io.Copy(clientConn, targetConn)
|
||||||
|
}()
|
||||||
|
|
||||||
|
wg.Wait()
|
||||||
|
}
|
||||||
|
|
||||||
|
// handleHTTP handles regular HTTP proxy requests.
|
||||||
|
func (p *HTTPProxy) handleHTTP(w http.ResponseWriter, r *http.Request) {
|
||||||
|
targetURL, err := url.Parse(r.RequestURI)
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, "Bad Request", http.StatusBadRequest)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
host := targetURL.Hostname()
|
||||||
|
port := 80
|
||||||
|
if targetURL.Port() != "" {
|
||||||
|
fmt.Sscanf(targetURL.Port(), "%d", &port)
|
||||||
|
} else if targetURL.Scheme == "https" {
|
||||||
|
port = 443
|
||||||
|
}
|
||||||
|
|
||||||
|
if !p.filter(host, port) {
|
||||||
|
p.logDebug("HTTP blocked: %s:%d", host, port)
|
||||||
|
http.Error(w, "Connection blocked by network allowlist", http.StatusForbidden)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
// Create new request and copy headers
|
||||||
|
proxyReq, err := http.NewRequest(r.Method, r.RequestURI, r.Body)
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
for key, values := range r.Header {
|
||||||
|
for _, value := range values {
|
||||||
|
proxyReq.Header.Add(key, value)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
proxyReq.Host = targetURL.Host
|
||||||
|
|
||||||
|
// Remove hop-by-hop headers
|
||||||
|
proxyReq.Header.Del("Proxy-Connection")
|
||||||
|
proxyReq.Header.Del("Proxy-Authorization")
|
||||||
|
|
||||||
|
client := &http.Client{
|
||||||
|
Timeout: 30 * time.Second,
|
||||||
|
CheckRedirect: func(req *http.Request, via []*http.Request) error {
|
||||||
|
return http.ErrUseLastResponse
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
resp, err := client.Do(proxyReq)
|
||||||
|
if err != nil {
|
||||||
|
p.logDebug("HTTP request failed: %v", err)
|
||||||
|
http.Error(w, "Bad Gateway", http.StatusBadGateway)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
|
||||||
|
// Copy response headers
|
||||||
|
for key, values := range resp.Header {
|
||||||
|
for _, value := range values {
|
||||||
|
w.Header().Add(key, value)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
w.WriteHeader(resp.StatusCode)
|
||||||
|
io.Copy(w, resp.Body)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (p *HTTPProxy) logDebug(format string, args ...interface{}) {
|
||||||
|
if p.debug {
|
||||||
|
fmt.Printf("[fence:http] "+format+"\n", args...)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// CreateDomainFilter creates a filter function from a config.
|
||||||
|
func CreateDomainFilter(cfg *config.Config, debug bool) FilterFunc {
|
||||||
|
return func(host string, port int) bool {
|
||||||
|
if cfg == nil {
|
||||||
|
// No config = deny all
|
||||||
|
if debug {
|
||||||
|
fmt.Printf("[fence:filter] No config, denying: %s:%d\n", host, port)
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check denied domains first
|
||||||
|
for _, denied := range cfg.Network.DeniedDomains {
|
||||||
|
if config.MatchesDomain(host, denied) {
|
||||||
|
if debug {
|
||||||
|
fmt.Printf("[fence:filter] Denied by rule: %s:%d (matched %s)\n", host, port, denied)
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check allowed domains
|
||||||
|
for _, allowed := range cfg.Network.AllowedDomains {
|
||||||
|
if config.MatchesDomain(host, allowed) {
|
||||||
|
if debug {
|
||||||
|
fmt.Printf("[fence:filter] Allowed by rule: %s:%d (matched %s)\n", host, port, allowed)
|
||||||
|
}
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if debug {
|
||||||
|
fmt.Printf("[fence:filter] No matching rule, denying: %s:%d\n", host, port)
|
||||||
|
}
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetHostFromRequest extracts the hostname from a request.
|
||||||
|
func GetHostFromRequest(r *http.Request) string {
|
||||||
|
host := r.Host
|
||||||
|
if h := r.URL.Hostname(); h != "" {
|
||||||
|
host = h
|
||||||
|
}
|
||||||
|
// Strip port
|
||||||
|
if idx := strings.LastIndex(host, ":"); idx != -1 {
|
||||||
|
host = host[:idx]
|
||||||
|
}
|
||||||
|
return host
|
||||||
|
}
|
||||||
95
internal/proxy/socks.go
Normal file
95
internal/proxy/socks.go
Normal file
@@ -0,0 +1,95 @@
|
|||||||
|
package proxy
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"net"
|
||||||
|
|
||||||
|
"github.com/things-go/go-socks5"
|
||||||
|
)
|
||||||
|
|
||||||
|
// SOCKSProxy is a SOCKS5 proxy server with domain filtering.
|
||||||
|
type SOCKSProxy struct {
|
||||||
|
server *socks5.Server
|
||||||
|
listener net.Listener
|
||||||
|
filter FilterFunc
|
||||||
|
debug bool
|
||||||
|
port int
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewSOCKSProxy creates a new SOCKS5 proxy with the given filter.
|
||||||
|
func NewSOCKSProxy(filter FilterFunc, debug bool) *SOCKSProxy {
|
||||||
|
return &SOCKSProxy{
|
||||||
|
filter: filter,
|
||||||
|
debug: debug,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// fenceRuleSet implements socks5.RuleSet for domain filtering.
|
||||||
|
type fenceRuleSet struct {
|
||||||
|
filter FilterFunc
|
||||||
|
debug bool
|
||||||
|
}
|
||||||
|
|
||||||
|
func (r *fenceRuleSet) Allow(ctx context.Context, req *socks5.Request) (context.Context, bool) {
|
||||||
|
host := req.DestAddr.FQDN
|
||||||
|
if host == "" {
|
||||||
|
host = req.DestAddr.IP.String()
|
||||||
|
}
|
||||||
|
port := req.DestAddr.Port
|
||||||
|
|
||||||
|
allowed := r.filter(host, port)
|
||||||
|
if r.debug {
|
||||||
|
if allowed {
|
||||||
|
fmt.Printf("[fence:socks] Allowed: %s:%d\n", host, port)
|
||||||
|
} else {
|
||||||
|
fmt.Printf("[fence:socks] Blocked: %s:%d\n", host, port)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return ctx, allowed
|
||||||
|
}
|
||||||
|
|
||||||
|
// Start starts the SOCKS5 proxy on a random available port.
|
||||||
|
func (p *SOCKSProxy) Start() (int, error) {
|
||||||
|
// Create listener first to get a random port
|
||||||
|
listener, err := net.Listen("tcp", "127.0.0.1:0")
|
||||||
|
if err != nil {
|
||||||
|
return 0, fmt.Errorf("failed to listen: %w", err)
|
||||||
|
}
|
||||||
|
p.listener = listener
|
||||||
|
p.port = listener.Addr().(*net.TCPAddr).Port
|
||||||
|
|
||||||
|
server := socks5.NewServer(
|
||||||
|
socks5.WithRule(&fenceRuleSet{
|
||||||
|
filter: p.filter,
|
||||||
|
debug: p.debug,
|
||||||
|
}),
|
||||||
|
)
|
||||||
|
p.server = server
|
||||||
|
|
||||||
|
go func() {
|
||||||
|
if err := p.server.Serve(p.listener); err != nil {
|
||||||
|
if p.debug {
|
||||||
|
fmt.Printf("[fence:socks] Server error: %v\n", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}()
|
||||||
|
|
||||||
|
if p.debug {
|
||||||
|
fmt.Printf("[fence:socks] SOCKS5 proxy listening on localhost:%d\n", p.port)
|
||||||
|
}
|
||||||
|
return p.port, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Stop stops the SOCKS5 proxy.
|
||||||
|
func (p *SOCKSProxy) Stop() error {
|
||||||
|
if p.listener != nil {
|
||||||
|
return p.listener.Close()
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Port returns the port the proxy is listening on.
|
||||||
|
func (p *SOCKSProxy) Port() int {
|
||||||
|
return p.port
|
||||||
|
}
|
||||||
84
internal/sandbox/dangerous.go
Normal file
84
internal/sandbox/dangerous.go
Normal file
@@ -0,0 +1,84 @@
|
|||||||
|
// Package sandbox provides sandboxing functionality for macOS and Linux.
|
||||||
|
package sandbox
|
||||||
|
|
||||||
|
import (
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
)
|
||||||
|
|
||||||
|
// DangerousFiles lists files that should be protected from writes.
|
||||||
|
// These files can be used for code execution or data exfiltration.
|
||||||
|
var DangerousFiles = []string{
|
||||||
|
".gitconfig",
|
||||||
|
".gitmodules",
|
||||||
|
".bashrc",
|
||||||
|
".bash_profile",
|
||||||
|
".zshrc",
|
||||||
|
".zprofile",
|
||||||
|
".profile",
|
||||||
|
".ripgreprc",
|
||||||
|
".mcp.json",
|
||||||
|
}
|
||||||
|
|
||||||
|
// DangerousDirectories lists directories that should be protected from writes.
|
||||||
|
// Excludes .git since we need it writable for git operations.
|
||||||
|
var DangerousDirectories = []string{
|
||||||
|
".vscode",
|
||||||
|
".idea",
|
||||||
|
".claude/commands",
|
||||||
|
".claude/agents",
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetDefaultWritePaths returns system paths that should be writable for commands to work.
|
||||||
|
func GetDefaultWritePaths() []string {
|
||||||
|
home, _ := os.UserHomeDir()
|
||||||
|
|
||||||
|
paths := []string{
|
||||||
|
"/dev/stdout",
|
||||||
|
"/dev/stderr",
|
||||||
|
"/dev/null",
|
||||||
|
"/dev/tty",
|
||||||
|
"/dev/dtracehelper",
|
||||||
|
"/dev/autofs_nowait",
|
||||||
|
"/tmp/fence",
|
||||||
|
"/private/tmp/fence",
|
||||||
|
}
|
||||||
|
|
||||||
|
if home != "" {
|
||||||
|
paths = append(paths,
|
||||||
|
filepath.Join(home, ".npm/_logs"),
|
||||||
|
filepath.Join(home, ".fence/debug"),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
return paths
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetMandatoryDenyPatterns returns glob patterns for paths that must always be protected.
|
||||||
|
func GetMandatoryDenyPatterns(cwd string, allowGitConfig bool) []string {
|
||||||
|
var patterns []string
|
||||||
|
|
||||||
|
// Dangerous files - in CWD and all subdirectories
|
||||||
|
for _, f := range DangerousFiles {
|
||||||
|
patterns = append(patterns, filepath.Join(cwd, f))
|
||||||
|
patterns = append(patterns, "**/"+f)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Dangerous directories
|
||||||
|
for _, d := range DangerousDirectories {
|
||||||
|
patterns = append(patterns, filepath.Join(cwd, d))
|
||||||
|
patterns = append(patterns, "**/"+d+"/**")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Git hooks are always blocked
|
||||||
|
patterns = append(patterns, filepath.Join(cwd, ".git/hooks"))
|
||||||
|
patterns = append(patterns, "**/.git/hooks/**")
|
||||||
|
|
||||||
|
// Git config is conditionally blocked
|
||||||
|
if !allowGitConfig {
|
||||||
|
patterns = append(patterns, filepath.Join(cwd, ".git/config"))
|
||||||
|
patterns = append(patterns, "**/.git/config")
|
||||||
|
}
|
||||||
|
|
||||||
|
return patterns
|
||||||
|
}
|
||||||
303
internal/sandbox/linux.go
Normal file
303
internal/sandbox/linux.go
Normal file
@@ -0,0 +1,303 @@
|
|||||||
|
package sandbox
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/hex"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"os/exec"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/Use-Tusk/fence/internal/config"
|
||||||
|
)
|
||||||
|
|
||||||
|
// LinuxBridge holds the socat bridge processes for Linux sandboxing (outbound).
|
||||||
|
type LinuxBridge struct {
|
||||||
|
HTTPSocketPath string
|
||||||
|
SOCKSSocketPath string
|
||||||
|
httpProcess *exec.Cmd
|
||||||
|
socksProcess *exec.Cmd
|
||||||
|
debug bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// ReverseBridge holds the socat bridge processes for inbound connections.
|
||||||
|
type ReverseBridge struct {
|
||||||
|
Ports []int
|
||||||
|
SocketPaths []string // Unix socket paths for each port
|
||||||
|
processes []*exec.Cmd
|
||||||
|
debug bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewLinuxBridge creates Unix socket bridges to the proxy servers.
|
||||||
|
// This allows sandboxed processes to communicate with the host's proxy (outbound).
|
||||||
|
func NewLinuxBridge(httpProxyPort, socksProxyPort int, debug bool) (*LinuxBridge, error) {
|
||||||
|
if _, err := exec.LookPath("socat"); err != nil {
|
||||||
|
return nil, fmt.Errorf("socat is required on Linux but not found: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
id := make([]byte, 8)
|
||||||
|
rand.Read(id)
|
||||||
|
socketID := hex.EncodeToString(id)
|
||||||
|
|
||||||
|
tmpDir := os.TempDir()
|
||||||
|
httpSocketPath := filepath.Join(tmpDir, fmt.Sprintf("fence-http-%s.sock", socketID))
|
||||||
|
socksSocketPath := filepath.Join(tmpDir, fmt.Sprintf("fence-socks-%s.sock", socketID))
|
||||||
|
|
||||||
|
bridge := &LinuxBridge{
|
||||||
|
HTTPSocketPath: httpSocketPath,
|
||||||
|
SOCKSSocketPath: socksSocketPath,
|
||||||
|
debug: debug,
|
||||||
|
}
|
||||||
|
|
||||||
|
// Start HTTP bridge: Unix socket -> TCP proxy
|
||||||
|
httpArgs := []string{
|
||||||
|
fmt.Sprintf("UNIX-LISTEN:%s,fork,reuseaddr", httpSocketPath),
|
||||||
|
fmt.Sprintf("TCP:localhost:%d", httpProxyPort),
|
||||||
|
}
|
||||||
|
bridge.httpProcess = exec.Command("socat", httpArgs...)
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Starting HTTP bridge: socat %s\n", strings.Join(httpArgs, " "))
|
||||||
|
}
|
||||||
|
if err := bridge.httpProcess.Start(); err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to start HTTP bridge: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Start SOCKS bridge: Unix socket -> TCP proxy
|
||||||
|
socksArgs := []string{
|
||||||
|
fmt.Sprintf("UNIX-LISTEN:%s,fork,reuseaddr", socksSocketPath),
|
||||||
|
fmt.Sprintf("TCP:localhost:%d", socksProxyPort),
|
||||||
|
}
|
||||||
|
bridge.socksProcess = exec.Command("socat", socksArgs...)
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Starting SOCKS bridge: socat %s\n", strings.Join(socksArgs, " "))
|
||||||
|
}
|
||||||
|
if err := bridge.socksProcess.Start(); err != nil {
|
||||||
|
bridge.Cleanup()
|
||||||
|
return nil, fmt.Errorf("failed to start SOCKS bridge: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Wait for sockets to be created
|
||||||
|
for i := 0; i < 50; i++ { // 5 seconds max
|
||||||
|
httpExists := fileExists(httpSocketPath)
|
||||||
|
socksExists := fileExists(socksSocketPath)
|
||||||
|
if httpExists && socksExists {
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Bridges ready (HTTP: %s, SOCKS: %s)\n", httpSocketPath, socksSocketPath)
|
||||||
|
}
|
||||||
|
return bridge, nil
|
||||||
|
}
|
||||||
|
time.Sleep(100 * time.Millisecond)
|
||||||
|
}
|
||||||
|
|
||||||
|
bridge.Cleanup()
|
||||||
|
return nil, fmt.Errorf("timeout waiting for bridge sockets to be created")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Cleanup stops the bridge processes and removes socket files.
|
||||||
|
func (b *LinuxBridge) Cleanup() {
|
||||||
|
if b.httpProcess != nil && b.httpProcess.Process != nil {
|
||||||
|
b.httpProcess.Process.Kill()
|
||||||
|
b.httpProcess.Wait()
|
||||||
|
}
|
||||||
|
if b.socksProcess != nil && b.socksProcess.Process != nil {
|
||||||
|
b.socksProcess.Process.Kill()
|
||||||
|
b.socksProcess.Wait()
|
||||||
|
}
|
||||||
|
|
||||||
|
// Clean up socket files
|
||||||
|
os.Remove(b.HTTPSocketPath)
|
||||||
|
os.Remove(b.SOCKSSocketPath)
|
||||||
|
|
||||||
|
if b.debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Bridges cleaned up\n")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewReverseBridge creates Unix socket bridges for inbound connections.
|
||||||
|
// Host listens on ports, forwards to Unix sockets that go into the sandbox.
|
||||||
|
func NewReverseBridge(ports []int, debug bool) (*ReverseBridge, error) {
|
||||||
|
if len(ports) == 0 {
|
||||||
|
return nil, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if _, err := exec.LookPath("socat"); err != nil {
|
||||||
|
return nil, fmt.Errorf("socat is required on Linux but not found: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
id := make([]byte, 8)
|
||||||
|
rand.Read(id)
|
||||||
|
socketID := hex.EncodeToString(id)
|
||||||
|
|
||||||
|
tmpDir := os.TempDir()
|
||||||
|
bridge := &ReverseBridge{
|
||||||
|
Ports: ports,
|
||||||
|
debug: debug,
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, port := range ports {
|
||||||
|
socketPath := filepath.Join(tmpDir, fmt.Sprintf("fence-rev-%d-%s.sock", port, socketID))
|
||||||
|
bridge.SocketPaths = append(bridge.SocketPaths, socketPath)
|
||||||
|
|
||||||
|
// Start reverse bridge: TCP listen on host port -> Unix socket
|
||||||
|
// The sandbox will create the Unix socket with UNIX-LISTEN
|
||||||
|
// We use retry to wait for the socket to be created by the sandbox
|
||||||
|
args := []string{
|
||||||
|
fmt.Sprintf("TCP-LISTEN:%d,fork,reuseaddr", port),
|
||||||
|
fmt.Sprintf("UNIX-CONNECT:%s,retry=50,interval=0.1", socketPath),
|
||||||
|
}
|
||||||
|
proc := exec.Command("socat", args...)
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Starting reverse bridge for port %d: socat %s\n", port, strings.Join(args, " "))
|
||||||
|
}
|
||||||
|
if err := proc.Start(); err != nil {
|
||||||
|
bridge.Cleanup()
|
||||||
|
return nil, fmt.Errorf("failed to start reverse bridge for port %d: %w", port, err)
|
||||||
|
}
|
||||||
|
bridge.processes = append(bridge.processes, proc)
|
||||||
|
}
|
||||||
|
|
||||||
|
if debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Reverse bridges ready for ports: %v\n", ports)
|
||||||
|
}
|
||||||
|
|
||||||
|
return bridge, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Cleanup stops the reverse bridge processes and removes socket files.
|
||||||
|
func (b *ReverseBridge) Cleanup() {
|
||||||
|
for _, proc := range b.processes {
|
||||||
|
if proc != nil && proc.Process != nil {
|
||||||
|
proc.Process.Kill()
|
||||||
|
proc.Wait()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Clean up socket files
|
||||||
|
for _, socketPath := range b.SocketPaths {
|
||||||
|
os.Remove(socketPath)
|
||||||
|
}
|
||||||
|
|
||||||
|
if b.debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Reverse bridges cleaned up\n")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func fileExists(path string) bool {
|
||||||
|
_, err := os.Stat(path)
|
||||||
|
return err == nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// WrapCommandLinux wraps a command with Linux bubblewrap sandbox.
|
||||||
|
func WrapCommandLinux(cfg *config.Config, command string, bridge *LinuxBridge, reverseBridge *ReverseBridge, debug bool) (string, error) {
|
||||||
|
// Check for bwrap
|
||||||
|
if _, err := exec.LookPath("bwrap"); err != nil {
|
||||||
|
return "", fmt.Errorf("bubblewrap (bwrap) is required on Linux but not found: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Find shell
|
||||||
|
shell := "bash"
|
||||||
|
shellPath, err := exec.LookPath(shell)
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("shell %q not found: %w", shell, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Build bwrap args
|
||||||
|
bwrapArgs := []string{
|
||||||
|
"bwrap",
|
||||||
|
"--new-session",
|
||||||
|
"--die-with-parent",
|
||||||
|
"--unshare-net", // Network namespace isolation
|
||||||
|
"--unshare-pid", // PID namespace isolation
|
||||||
|
"--bind", "/", "/", // Bind root filesystem
|
||||||
|
"--dev", "/dev", // Mount /dev
|
||||||
|
"--proc", "/proc", // Mount /proc
|
||||||
|
}
|
||||||
|
|
||||||
|
// Bind the outbound Unix sockets into the sandbox
|
||||||
|
if bridge != nil {
|
||||||
|
bwrapArgs = append(bwrapArgs,
|
||||||
|
"--bind", bridge.HTTPSocketPath, bridge.HTTPSocketPath,
|
||||||
|
"--bind", bridge.SOCKSSocketPath, bridge.SOCKSSocketPath,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Note: Reverse (inbound) Unix sockets don't need explicit binding
|
||||||
|
// because we use --bind / / which shares the entire filesystem.
|
||||||
|
// The sandbox-side socat creates the socket, which is visible to the host.
|
||||||
|
|
||||||
|
// Add environment variables for the sandbox
|
||||||
|
bwrapArgs = append(bwrapArgs, "--", shellPath, "-c")
|
||||||
|
|
||||||
|
// Build the inner command that sets up socat listeners and runs the user command
|
||||||
|
var innerScript strings.Builder
|
||||||
|
|
||||||
|
if bridge != nil {
|
||||||
|
// Set up outbound socat listeners inside the sandbox
|
||||||
|
innerScript.WriteString(fmt.Sprintf(`
|
||||||
|
# Start HTTP proxy listener (port 3128 -> Unix socket -> host HTTP proxy)
|
||||||
|
socat TCP-LISTEN:3128,fork,reuseaddr UNIX-CONNECT:%s >/dev/null 2>&1 &
|
||||||
|
HTTP_PID=$!
|
||||||
|
|
||||||
|
# Start SOCKS proxy listener (port 1080 -> Unix socket -> host SOCKS proxy)
|
||||||
|
socat TCP-LISTEN:1080,fork,reuseaddr UNIX-CONNECT:%s >/dev/null 2>&1 &
|
||||||
|
SOCKS_PID=$!
|
||||||
|
|
||||||
|
# Set proxy environment variables
|
||||||
|
export HTTP_PROXY=http://127.0.0.1:3128
|
||||||
|
export HTTPS_PROXY=http://127.0.0.1:3128
|
||||||
|
export http_proxy=http://127.0.0.1:3128
|
||||||
|
export https_proxy=http://127.0.0.1:3128
|
||||||
|
export ALL_PROXY=socks5h://127.0.0.1:1080
|
||||||
|
export all_proxy=socks5h://127.0.0.1:1080
|
||||||
|
export NO_PROXY=localhost,127.0.0.1
|
||||||
|
export no_proxy=localhost,127.0.0.1
|
||||||
|
export FENCE_SANDBOX=1
|
||||||
|
|
||||||
|
`, bridge.HTTPSocketPath, bridge.SOCKSSocketPath))
|
||||||
|
}
|
||||||
|
|
||||||
|
// Set up reverse (inbound) socat listeners inside the sandbox
|
||||||
|
if reverseBridge != nil && len(reverseBridge.Ports) > 0 {
|
||||||
|
innerScript.WriteString("\n# Start reverse bridge listeners for inbound connections\n")
|
||||||
|
for i, port := range reverseBridge.Ports {
|
||||||
|
socketPath := reverseBridge.SocketPaths[i]
|
||||||
|
// Listen on Unix socket, forward to localhost:port inside the sandbox
|
||||||
|
innerScript.WriteString(fmt.Sprintf(
|
||||||
|
"socat UNIX-LISTEN:%s,fork,reuseaddr TCP:127.0.0.1:%d >/dev/null 2>&1 &\n",
|
||||||
|
socketPath, port,
|
||||||
|
))
|
||||||
|
innerScript.WriteString(fmt.Sprintf("REV_%d_PID=$!\n", port))
|
||||||
|
}
|
||||||
|
innerScript.WriteString("\n")
|
||||||
|
}
|
||||||
|
|
||||||
|
// Add cleanup function
|
||||||
|
innerScript.WriteString(`
|
||||||
|
# Cleanup function
|
||||||
|
cleanup() {
|
||||||
|
jobs -p | xargs -r kill 2>/dev/null
|
||||||
|
}
|
||||||
|
trap cleanup EXIT
|
||||||
|
|
||||||
|
# Small delay to ensure socat listeners are ready
|
||||||
|
sleep 0.1
|
||||||
|
|
||||||
|
# Run the user command
|
||||||
|
`)
|
||||||
|
innerScript.WriteString(command)
|
||||||
|
innerScript.WriteString("\n")
|
||||||
|
|
||||||
|
bwrapArgs = append(bwrapArgs, innerScript.String())
|
||||||
|
|
||||||
|
if debug {
|
||||||
|
if reverseBridge != nil && len(reverseBridge.Ports) > 0 {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Wrapping command with bwrap (network filtering + inbound ports: %v)\n", reverseBridge.Ports)
|
||||||
|
} else {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:linux] Wrapping command with bwrap (network filtering via socat bridges)\n")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return ShellQuote(bwrapArgs), nil
|
||||||
|
}
|
||||||
558
internal/sandbox/macos.go
Normal file
558
internal/sandbox/macos.go
Normal file
@@ -0,0 +1,558 @@
|
|||||||
|
package sandbox
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/hex"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"os/exec"
|
||||||
|
"path/filepath"
|
||||||
|
"regexp"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/Use-Tusk/fence/internal/config"
|
||||||
|
)
|
||||||
|
|
||||||
|
// sessionSuffix is a unique identifier for this process session.
|
||||||
|
var sessionSuffix = generateSessionSuffix()
|
||||||
|
|
||||||
|
func generateSessionSuffix() string {
|
||||||
|
bytes := make([]byte, 8)
|
||||||
|
rand.Read(bytes)
|
||||||
|
return "_" + hex.EncodeToString(bytes)[:9] + "_SBX"
|
||||||
|
}
|
||||||
|
|
||||||
|
// MacOSSandboxParams contains parameters for macOS sandbox wrapping.
|
||||||
|
type MacOSSandboxParams struct {
|
||||||
|
Command string
|
||||||
|
NeedsNetworkRestriction bool
|
||||||
|
HTTPProxyPort int
|
||||||
|
SOCKSProxyPort int
|
||||||
|
AllowUnixSockets []string
|
||||||
|
AllowAllUnixSockets bool
|
||||||
|
AllowLocalBinding bool
|
||||||
|
ReadDenyPaths []string
|
||||||
|
WriteAllowPaths []string
|
||||||
|
WriteDenyPaths []string
|
||||||
|
AllowPty bool
|
||||||
|
AllowGitConfig bool
|
||||||
|
Shell string
|
||||||
|
}
|
||||||
|
|
||||||
|
// GlobToRegex converts a glob pattern to a regex for macOS sandbox profiles.
|
||||||
|
func GlobToRegex(glob string) string {
|
||||||
|
result := "^"
|
||||||
|
|
||||||
|
// Escape regex special characters (except glob chars)
|
||||||
|
escaped := regexp.QuoteMeta(glob)
|
||||||
|
|
||||||
|
// Restore glob patterns and convert them
|
||||||
|
// Order matters: ** before *
|
||||||
|
escaped = strings.ReplaceAll(escaped, `\*\*/`, "(.*/)?")
|
||||||
|
escaped = strings.ReplaceAll(escaped, `\*\*`, ".*")
|
||||||
|
escaped = strings.ReplaceAll(escaped, `\*`, "[^/]*")
|
||||||
|
escaped = strings.ReplaceAll(escaped, `\?`, "[^/]")
|
||||||
|
|
||||||
|
result += escaped + "$"
|
||||||
|
return result
|
||||||
|
}
|
||||||
|
|
||||||
|
// escapePath escapes a path for sandbox profile using JSON encoding.
|
||||||
|
func escapePath(path string) string {
|
||||||
|
// Use Go's string quoting which handles escaping
|
||||||
|
return fmt.Sprintf("%q", path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// getAncestorDirectories returns all ancestor directories of a path.
|
||||||
|
func getAncestorDirectories(pathStr string) []string {
|
||||||
|
var ancestors []string
|
||||||
|
current := filepath.Dir(pathStr)
|
||||||
|
|
||||||
|
for current != "/" && current != "." {
|
||||||
|
ancestors = append(ancestors, current)
|
||||||
|
parent := filepath.Dir(current)
|
||||||
|
if parent == current {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
current = parent
|
||||||
|
}
|
||||||
|
|
||||||
|
return ancestors
|
||||||
|
}
|
||||||
|
|
||||||
|
// getTmpdirParent gets the TMPDIR parent if it matches macOS pattern.
|
||||||
|
func getTmpdirParent() []string {
|
||||||
|
tmpdir := os.Getenv("TMPDIR")
|
||||||
|
if tmpdir == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Match /var/folders/XX/YYY/T/
|
||||||
|
pattern := regexp.MustCompile(`^/(private/)?var/folders/[^/]{2}/[^/]+/T/?$`)
|
||||||
|
if !pattern.MatchString(tmpdir) {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
parent := strings.TrimSuffix(tmpdir, "/")
|
||||||
|
parent = strings.TrimSuffix(parent, "/T")
|
||||||
|
|
||||||
|
// Return both /var/ and /private/var/ versions
|
||||||
|
if strings.HasPrefix(parent, "/private/var/") {
|
||||||
|
return []string{parent, strings.Replace(parent, "/private", "", 1)}
|
||||||
|
} else if strings.HasPrefix(parent, "/var/") {
|
||||||
|
return []string{parent, "/private" + parent}
|
||||||
|
}
|
||||||
|
|
||||||
|
return []string{parent}
|
||||||
|
}
|
||||||
|
|
||||||
|
// generateReadRules generates filesystem read rules for the sandbox profile.
|
||||||
|
func generateReadRules(denyPaths []string, logTag string) []string {
|
||||||
|
var rules []string
|
||||||
|
|
||||||
|
// Allow all reads by default
|
||||||
|
rules = append(rules, "(allow file-read*)")
|
||||||
|
|
||||||
|
// Deny specific paths
|
||||||
|
for _, pathPattern := range denyPaths {
|
||||||
|
normalized := NormalizePath(pathPattern)
|
||||||
|
|
||||||
|
if ContainsGlobChars(normalized) {
|
||||||
|
regex := GlobToRegex(normalized)
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-read*",
|
||||||
|
fmt.Sprintf(" (regex %s)", escapePath(regex)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
} else {
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-read*",
|
||||||
|
fmt.Sprintf(" (subpath %s)", escapePath(normalized)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Block file movement to prevent bypass
|
||||||
|
rules = append(rules, generateMoveBlockingRules(denyPaths, logTag)...)
|
||||||
|
|
||||||
|
return rules
|
||||||
|
}
|
||||||
|
|
||||||
|
// generateWriteRules generates filesystem write rules for the sandbox profile.
|
||||||
|
func generateWriteRules(allowPaths, denyPaths []string, allowGitConfig bool, logTag string) []string {
|
||||||
|
var rules []string
|
||||||
|
|
||||||
|
// Allow TMPDIR parent on macOS
|
||||||
|
for _, tmpdirParent := range getTmpdirParent() {
|
||||||
|
normalized := NormalizePath(tmpdirParent)
|
||||||
|
rules = append(rules,
|
||||||
|
"(allow file-write*",
|
||||||
|
fmt.Sprintf(" (subpath %s)", escapePath(normalized)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Generate allow rules
|
||||||
|
for _, pathPattern := range allowPaths {
|
||||||
|
normalized := NormalizePath(pathPattern)
|
||||||
|
|
||||||
|
if ContainsGlobChars(normalized) {
|
||||||
|
regex := GlobToRegex(normalized)
|
||||||
|
rules = append(rules,
|
||||||
|
"(allow file-write*",
|
||||||
|
fmt.Sprintf(" (regex %s)", escapePath(regex)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
} else {
|
||||||
|
rules = append(rules,
|
||||||
|
"(allow file-write*",
|
||||||
|
fmt.Sprintf(" (subpath %s)", escapePath(normalized)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Combine user-specified and mandatory deny patterns
|
||||||
|
cwd, _ := os.Getwd()
|
||||||
|
allDenyPaths := append(denyPaths, GetMandatoryDenyPatterns(cwd, allowGitConfig)...)
|
||||||
|
|
||||||
|
for _, pathPattern := range allDenyPaths {
|
||||||
|
normalized := NormalizePath(pathPattern)
|
||||||
|
|
||||||
|
if ContainsGlobChars(normalized) {
|
||||||
|
regex := GlobToRegex(normalized)
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-write*",
|
||||||
|
fmt.Sprintf(" (regex %s)", escapePath(regex)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
} else {
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-write*",
|
||||||
|
fmt.Sprintf(" (subpath %s)", escapePath(normalized)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Block file movement
|
||||||
|
rules = append(rules, generateMoveBlockingRules(allDenyPaths, logTag)...)
|
||||||
|
|
||||||
|
return rules
|
||||||
|
}
|
||||||
|
|
||||||
|
// generateMoveBlockingRules generates rules to prevent file movement bypasses.
|
||||||
|
func generateMoveBlockingRules(pathPatterns []string, logTag string) []string {
|
||||||
|
var rules []string
|
||||||
|
|
||||||
|
for _, pathPattern := range pathPatterns {
|
||||||
|
normalized := NormalizePath(pathPattern)
|
||||||
|
|
||||||
|
if ContainsGlobChars(normalized) {
|
||||||
|
regex := GlobToRegex(normalized)
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-write-unlink",
|
||||||
|
fmt.Sprintf(" (regex %s)", escapePath(regex)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
|
||||||
|
// For globs, extract static prefix and block ancestor moves
|
||||||
|
staticPrefix := strings.Split(normalized, "*")[0]
|
||||||
|
if staticPrefix != "" && staticPrefix != "/" {
|
||||||
|
baseDir := staticPrefix
|
||||||
|
if strings.HasSuffix(baseDir, "/") {
|
||||||
|
baseDir = baseDir[:len(baseDir)-1]
|
||||||
|
} else {
|
||||||
|
baseDir = filepath.Dir(staticPrefix)
|
||||||
|
}
|
||||||
|
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-write-unlink",
|
||||||
|
fmt.Sprintf(" (literal %s)", escapePath(baseDir)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
|
||||||
|
for _, ancestor := range getAncestorDirectories(baseDir) {
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-write-unlink",
|
||||||
|
fmt.Sprintf(" (literal %s)", escapePath(ancestor)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-write-unlink",
|
||||||
|
fmt.Sprintf(" (subpath %s)", escapePath(normalized)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
|
||||||
|
for _, ancestor := range getAncestorDirectories(normalized) {
|
||||||
|
rules = append(rules,
|
||||||
|
"(deny file-write-unlink",
|
||||||
|
fmt.Sprintf(" (literal %s)", escapePath(ancestor)),
|
||||||
|
fmt.Sprintf(" (with message %q))", logTag),
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return rules
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateSandboxProfile generates a complete macOS sandbox profile.
|
||||||
|
func GenerateSandboxProfile(params MacOSSandboxParams) string {
|
||||||
|
logTag := "CMD64_" + EncodeSandboxedCommand(params.Command) + "_END" + sessionSuffix
|
||||||
|
|
||||||
|
var profile strings.Builder
|
||||||
|
|
||||||
|
// Header
|
||||||
|
profile.WriteString("(version 1)\n")
|
||||||
|
profile.WriteString(fmt.Sprintf("(deny default (with message %q))\n\n", logTag))
|
||||||
|
profile.WriteString(fmt.Sprintf("; LogTag: %s\n\n", logTag))
|
||||||
|
|
||||||
|
// Essential permissions - based on Chrome sandbox policy
|
||||||
|
profile.WriteString(`; Essential permissions - based on Chrome sandbox policy
|
||||||
|
; Process permissions
|
||||||
|
(allow process-exec)
|
||||||
|
(allow process-fork)
|
||||||
|
(allow process-info* (target same-sandbox))
|
||||||
|
(allow signal (target same-sandbox))
|
||||||
|
(allow mach-priv-task-port (target same-sandbox))
|
||||||
|
|
||||||
|
; User preferences
|
||||||
|
(allow user-preference-read)
|
||||||
|
|
||||||
|
; Mach IPC - specific services only
|
||||||
|
(allow mach-lookup
|
||||||
|
(global-name "com.apple.audio.systemsoundserver")
|
||||||
|
(global-name "com.apple.distributed_notifications@Uv3")
|
||||||
|
(global-name "com.apple.FontObjectsServer")
|
||||||
|
(global-name "com.apple.fonts")
|
||||||
|
(global-name "com.apple.logd")
|
||||||
|
(global-name "com.apple.lsd.mapdb")
|
||||||
|
(global-name "com.apple.PowerManagement.control")
|
||||||
|
(global-name "com.apple.system.logger")
|
||||||
|
(global-name "com.apple.system.notification_center")
|
||||||
|
(global-name "com.apple.trustd.agent")
|
||||||
|
(global-name "com.apple.system.opendirectoryd.libinfo")
|
||||||
|
(global-name "com.apple.system.opendirectoryd.membership")
|
||||||
|
(global-name "com.apple.bsd.dirhelper")
|
||||||
|
(global-name "com.apple.securityd.xpc")
|
||||||
|
(global-name "com.apple.coreservices.launchservicesd")
|
||||||
|
)
|
||||||
|
|
||||||
|
; POSIX IPC
|
||||||
|
(allow ipc-posix-shm)
|
||||||
|
(allow ipc-posix-sem)
|
||||||
|
|
||||||
|
; IOKit
|
||||||
|
(allow iokit-open
|
||||||
|
(iokit-registry-entry-class "IOSurfaceRootUserClient")
|
||||||
|
(iokit-registry-entry-class "RootDomainUserClient")
|
||||||
|
(iokit-user-client-class "IOSurfaceSendRight")
|
||||||
|
)
|
||||||
|
(allow iokit-get-properties)
|
||||||
|
|
||||||
|
; System socket for network info
|
||||||
|
(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))
|
||||||
|
|
||||||
|
; sysctl reads
|
||||||
|
(allow sysctl-read
|
||||||
|
(sysctl-name "hw.activecpu")
|
||||||
|
(sysctl-name "hw.busfrequency_compat")
|
||||||
|
(sysctl-name "hw.byteorder")
|
||||||
|
(sysctl-name "hw.cacheconfig")
|
||||||
|
(sysctl-name "hw.cachelinesize_compat")
|
||||||
|
(sysctl-name "hw.cpufamily")
|
||||||
|
(sysctl-name "hw.cpufrequency")
|
||||||
|
(sysctl-name "hw.cpufrequency_compat")
|
||||||
|
(sysctl-name "hw.cputype")
|
||||||
|
(sysctl-name "hw.l1dcachesize_compat")
|
||||||
|
(sysctl-name "hw.l1icachesize_compat")
|
||||||
|
(sysctl-name "hw.l2cachesize_compat")
|
||||||
|
(sysctl-name "hw.l3cachesize_compat")
|
||||||
|
(sysctl-name "hw.logicalcpu")
|
||||||
|
(sysctl-name "hw.logicalcpu_max")
|
||||||
|
(sysctl-name "hw.machine")
|
||||||
|
(sysctl-name "hw.memsize")
|
||||||
|
(sysctl-name "hw.ncpu")
|
||||||
|
(sysctl-name "hw.nperflevels")
|
||||||
|
(sysctl-name "hw.packages")
|
||||||
|
(sysctl-name "hw.pagesize_compat")
|
||||||
|
(sysctl-name "hw.pagesize")
|
||||||
|
(sysctl-name "hw.physicalcpu")
|
||||||
|
(sysctl-name "hw.physicalcpu_max")
|
||||||
|
(sysctl-name "hw.tbfrequency_compat")
|
||||||
|
(sysctl-name "hw.vectorunit")
|
||||||
|
(sysctl-name "kern.argmax")
|
||||||
|
(sysctl-name "kern.bootargs")
|
||||||
|
(sysctl-name "kern.hostname")
|
||||||
|
(sysctl-name "kern.maxfiles")
|
||||||
|
(sysctl-name "kern.maxfilesperproc")
|
||||||
|
(sysctl-name "kern.maxproc")
|
||||||
|
(sysctl-name "kern.ngroups")
|
||||||
|
(sysctl-name "kern.osproductversion")
|
||||||
|
(sysctl-name "kern.osrelease")
|
||||||
|
(sysctl-name "kern.ostype")
|
||||||
|
(sysctl-name "kern.osvariant_status")
|
||||||
|
(sysctl-name "kern.osversion")
|
||||||
|
(sysctl-name "kern.secure_kernel")
|
||||||
|
(sysctl-name "kern.tcsm_available")
|
||||||
|
(sysctl-name "kern.tcsm_enable")
|
||||||
|
(sysctl-name "kern.usrstack64")
|
||||||
|
(sysctl-name "kern.version")
|
||||||
|
(sysctl-name "kern.willshutdown")
|
||||||
|
(sysctl-name "machdep.cpu.brand_string")
|
||||||
|
(sysctl-name "machdep.ptrauth_enabled")
|
||||||
|
(sysctl-name "security.mac.lockdown_mode_state")
|
||||||
|
(sysctl-name "sysctl.proc_cputype")
|
||||||
|
(sysctl-name "vm.loadavg")
|
||||||
|
(sysctl-name-prefix "hw.optional.arm")
|
||||||
|
(sysctl-name-prefix "hw.optional.arm.")
|
||||||
|
(sysctl-name-prefix "hw.optional.armv8_")
|
||||||
|
(sysctl-name-prefix "hw.perflevel")
|
||||||
|
(sysctl-name-prefix "kern.proc.all")
|
||||||
|
(sysctl-name-prefix "kern.proc.pgrp.")
|
||||||
|
(sysctl-name-prefix "kern.proc.pid.")
|
||||||
|
(sysctl-name-prefix "machdep.cpu.")
|
||||||
|
(sysctl-name-prefix "net.routetable.")
|
||||||
|
)
|
||||||
|
|
||||||
|
; V8 thread calculations
|
||||||
|
(allow sysctl-write
|
||||||
|
(sysctl-name "kern.tcsm_enable")
|
||||||
|
)
|
||||||
|
|
||||||
|
; Distributed notifications
|
||||||
|
(allow distributed-notification-post)
|
||||||
|
|
||||||
|
; Security server
|
||||||
|
(allow mach-lookup (global-name "com.apple.SecurityServer"))
|
||||||
|
|
||||||
|
; Device I/O
|
||||||
|
(allow file-ioctl (literal "/dev/null"))
|
||||||
|
(allow file-ioctl (literal "/dev/zero"))
|
||||||
|
(allow file-ioctl (literal "/dev/random"))
|
||||||
|
(allow file-ioctl (literal "/dev/urandom"))
|
||||||
|
(allow file-ioctl (literal "/dev/dtracehelper"))
|
||||||
|
(allow file-ioctl (literal "/dev/tty"))
|
||||||
|
|
||||||
|
(allow file-ioctl file-read-data file-write-data
|
||||||
|
(require-all
|
||||||
|
(literal "/dev/null")
|
||||||
|
(vnode-type CHARACTER-DEVICE)
|
||||||
|
)
|
||||||
|
)
|
||||||
|
|
||||||
|
`)
|
||||||
|
|
||||||
|
// Network rules
|
||||||
|
profile.WriteString("; Network\n")
|
||||||
|
if !params.NeedsNetworkRestriction {
|
||||||
|
profile.WriteString("(allow network*)\n")
|
||||||
|
} else {
|
||||||
|
if params.AllowLocalBinding {
|
||||||
|
profile.WriteString(`(allow network-bind (local ip "localhost:*"))
|
||||||
|
(allow network-inbound (local ip "localhost:*"))
|
||||||
|
(allow network-outbound (local ip "localhost:*"))
|
||||||
|
`)
|
||||||
|
}
|
||||||
|
|
||||||
|
if params.AllowAllUnixSockets {
|
||||||
|
profile.WriteString("(allow network* (subpath \"/\"))\n")
|
||||||
|
} else if len(params.AllowUnixSockets) > 0 {
|
||||||
|
for _, socketPath := range params.AllowUnixSockets {
|
||||||
|
normalized := NormalizePath(socketPath)
|
||||||
|
profile.WriteString(fmt.Sprintf("(allow network* (subpath %s))\n", escapePath(normalized)))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if params.HTTPProxyPort > 0 {
|
||||||
|
profile.WriteString(fmt.Sprintf(`(allow network-bind (local ip "localhost:%d"))
|
||||||
|
(allow network-inbound (local ip "localhost:%d"))
|
||||||
|
(allow network-outbound (remote ip "localhost:%d"))
|
||||||
|
`, params.HTTPProxyPort, params.HTTPProxyPort, params.HTTPProxyPort))
|
||||||
|
}
|
||||||
|
|
||||||
|
if params.SOCKSProxyPort > 0 {
|
||||||
|
profile.WriteString(fmt.Sprintf(`(allow network-bind (local ip "localhost:%d"))
|
||||||
|
(allow network-inbound (local ip "localhost:%d"))
|
||||||
|
(allow network-outbound (remote ip "localhost:%d"))
|
||||||
|
`, params.SOCKSProxyPort, params.SOCKSProxyPort, params.SOCKSProxyPort))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
profile.WriteString("\n")
|
||||||
|
|
||||||
|
// Read rules
|
||||||
|
profile.WriteString("; File read\n")
|
||||||
|
for _, rule := range generateReadRules(params.ReadDenyPaths, logTag) {
|
||||||
|
profile.WriteString(rule + "\n")
|
||||||
|
}
|
||||||
|
profile.WriteString("\n")
|
||||||
|
|
||||||
|
// Write rules
|
||||||
|
profile.WriteString("; File write\n")
|
||||||
|
for _, rule := range generateWriteRules(params.WriteAllowPaths, params.WriteDenyPaths, params.AllowGitConfig, logTag) {
|
||||||
|
profile.WriteString(rule + "\n")
|
||||||
|
}
|
||||||
|
|
||||||
|
// PTY support
|
||||||
|
if params.AllowPty {
|
||||||
|
profile.WriteString(`
|
||||||
|
; Pseudo-terminal (pty) support
|
||||||
|
(allow pseudo-tty)
|
||||||
|
(allow file-ioctl
|
||||||
|
(literal "/dev/ptmx")
|
||||||
|
(regex #"^/dev/ttys")
|
||||||
|
)
|
||||||
|
(allow file-read* file-write*
|
||||||
|
(literal "/dev/ptmx")
|
||||||
|
(regex #"^/dev/ttys")
|
||||||
|
)
|
||||||
|
`)
|
||||||
|
}
|
||||||
|
|
||||||
|
return profile.String()
|
||||||
|
}
|
||||||
|
|
||||||
|
// WrapCommandMacOS wraps a command with macOS sandbox restrictions.
|
||||||
|
func WrapCommandMacOS(cfg *config.Config, command string, httpPort, socksPort int, exposedPorts []int, debug bool) (string, error) {
|
||||||
|
needsNetwork := len(cfg.Network.AllowedDomains) > 0 || len(cfg.Network.DeniedDomains) > 0
|
||||||
|
|
||||||
|
// Build allow paths: default + configured
|
||||||
|
allowPaths := append(GetDefaultWritePaths(), cfg.Filesystem.AllowWrite...)
|
||||||
|
|
||||||
|
// Enable local binding if ports are exposed or if explicitly configured
|
||||||
|
allowLocalBinding := cfg.Network.AllowLocalBinding || len(exposedPorts) > 0
|
||||||
|
|
||||||
|
params := MacOSSandboxParams{
|
||||||
|
Command: command,
|
||||||
|
NeedsNetworkRestriction: needsNetwork || len(cfg.Network.AllowedDomains) == 0, // Block if no domains allowed
|
||||||
|
HTTPProxyPort: httpPort,
|
||||||
|
SOCKSProxyPort: socksPort,
|
||||||
|
AllowUnixSockets: cfg.Network.AllowUnixSockets,
|
||||||
|
AllowAllUnixSockets: cfg.Network.AllowAllUnixSockets,
|
||||||
|
AllowLocalBinding: allowLocalBinding,
|
||||||
|
ReadDenyPaths: cfg.Filesystem.DenyRead,
|
||||||
|
WriteAllowPaths: allowPaths,
|
||||||
|
WriteDenyPaths: cfg.Filesystem.DenyWrite,
|
||||||
|
AllowPty: cfg.AllowPty,
|
||||||
|
AllowGitConfig: cfg.Filesystem.AllowGitConfig,
|
||||||
|
}
|
||||||
|
|
||||||
|
if debug && len(exposedPorts) > 0 {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence:macos] Enabling local binding for exposed ports: %v\n", exposedPorts)
|
||||||
|
}
|
||||||
|
|
||||||
|
profile := GenerateSandboxProfile(params)
|
||||||
|
|
||||||
|
// Find shell
|
||||||
|
shell := params.Shell
|
||||||
|
if shell == "" {
|
||||||
|
shell = "bash"
|
||||||
|
}
|
||||||
|
shellPath, err := exec.LookPath(shell)
|
||||||
|
if err != nil {
|
||||||
|
return "", fmt.Errorf("shell %q not found: %w", shell, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Generate proxy environment variables
|
||||||
|
proxyEnvs := GenerateProxyEnvVars(httpPort, socksPort)
|
||||||
|
|
||||||
|
// Build the command
|
||||||
|
// env VAR1=val1 VAR2=val2 sandbox-exec -p 'profile' shell -c 'command'
|
||||||
|
var parts []string
|
||||||
|
parts = append(parts, "env")
|
||||||
|
parts = append(parts, proxyEnvs...)
|
||||||
|
parts = append(parts, "sandbox-exec", "-p", profile, shellPath, "-c", command)
|
||||||
|
|
||||||
|
return ShellQuote(parts), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ShellQuote quotes a slice of strings for shell execution.
|
||||||
|
func ShellQuote(args []string) string {
|
||||||
|
var quoted []string
|
||||||
|
for _, arg := range args {
|
||||||
|
if needsQuoting(arg) {
|
||||||
|
quoted = append(quoted, fmt.Sprintf("'%s'", strings.ReplaceAll(arg, "'", "'\\''")))
|
||||||
|
} else {
|
||||||
|
quoted = append(quoted, arg)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return strings.Join(quoted, " ")
|
||||||
|
}
|
||||||
|
|
||||||
|
func needsQuoting(s string) bool {
|
||||||
|
for _, c := range s {
|
||||||
|
if c == ' ' || c == '\t' || c == '\n' || c == '"' || c == '\'' ||
|
||||||
|
c == '\\' || c == '$' || c == '`' || c == '!' || c == '*' ||
|
||||||
|
c == '?' || c == '[' || c == ']' || c == '(' || c == ')' ||
|
||||||
|
c == '{' || c == '}' || c == '<' || c == '>' || c == '|' ||
|
||||||
|
c == '&' || c == ';' || c == '#' {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return len(s) == 0
|
||||||
|
}
|
||||||
144
internal/sandbox/manager.go
Normal file
144
internal/sandbox/manager.go
Normal file
@@ -0,0 +1,144 @@
|
|||||||
|
package sandbox
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
|
||||||
|
"github.com/Use-Tusk/fence/internal/config"
|
||||||
|
"github.com/Use-Tusk/fence/internal/platform"
|
||||||
|
"github.com/Use-Tusk/fence/internal/proxy"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Manager handles sandbox initialization and command wrapping.
|
||||||
|
type Manager struct {
|
||||||
|
config *config.Config
|
||||||
|
httpProxy *proxy.HTTPProxy
|
||||||
|
socksProxy *proxy.SOCKSProxy
|
||||||
|
linuxBridge *LinuxBridge
|
||||||
|
reverseBridge *ReverseBridge
|
||||||
|
httpPort int
|
||||||
|
socksPort int
|
||||||
|
exposedPorts []int
|
||||||
|
debug bool
|
||||||
|
initialized bool
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewManager creates a new sandbox manager.
|
||||||
|
func NewManager(cfg *config.Config, debug bool) *Manager {
|
||||||
|
return &Manager{
|
||||||
|
config: cfg,
|
||||||
|
debug: debug,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetExposedPorts sets the ports to expose for inbound connections.
|
||||||
|
func (m *Manager) SetExposedPorts(ports []int) {
|
||||||
|
m.exposedPorts = ports
|
||||||
|
}
|
||||||
|
|
||||||
|
// Initialize sets up the sandbox infrastructure (proxies, etc.).
|
||||||
|
func (m *Manager) Initialize() error {
|
||||||
|
if m.initialized {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if !platform.IsSupported() {
|
||||||
|
return fmt.Errorf("sandbox is not supported on platform: %s", platform.Detect())
|
||||||
|
}
|
||||||
|
|
||||||
|
filter := proxy.CreateDomainFilter(m.config, m.debug)
|
||||||
|
|
||||||
|
m.httpProxy = proxy.NewHTTPProxy(filter, m.debug)
|
||||||
|
httpPort, err := m.httpProxy.Start()
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("failed to start HTTP proxy: %w", err)
|
||||||
|
}
|
||||||
|
m.httpPort = httpPort
|
||||||
|
|
||||||
|
m.socksProxy = proxy.NewSOCKSProxy(filter, m.debug)
|
||||||
|
socksPort, err := m.socksProxy.Start()
|
||||||
|
if err != nil {
|
||||||
|
m.httpProxy.Stop()
|
||||||
|
return fmt.Errorf("failed to start SOCKS proxy: %w", err)
|
||||||
|
}
|
||||||
|
m.socksPort = socksPort
|
||||||
|
|
||||||
|
// On Linux, set up the socat bridges
|
||||||
|
if platform.Detect() == platform.Linux {
|
||||||
|
bridge, err := NewLinuxBridge(m.httpPort, m.socksPort, m.debug)
|
||||||
|
if err != nil {
|
||||||
|
m.httpProxy.Stop()
|
||||||
|
m.socksProxy.Stop()
|
||||||
|
return fmt.Errorf("failed to initialize Linux bridge: %w", err)
|
||||||
|
}
|
||||||
|
m.linuxBridge = bridge
|
||||||
|
|
||||||
|
// Set up reverse bridge for exposed ports (inbound connections)
|
||||||
|
if len(m.exposedPorts) > 0 {
|
||||||
|
reverseBridge, err := NewReverseBridge(m.exposedPorts, m.debug)
|
||||||
|
if err != nil {
|
||||||
|
m.linuxBridge.Cleanup()
|
||||||
|
m.httpProxy.Stop()
|
||||||
|
m.socksProxy.Stop()
|
||||||
|
return fmt.Errorf("failed to initialize reverse bridge: %w", err)
|
||||||
|
}
|
||||||
|
m.reverseBridge = reverseBridge
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
m.initialized = true
|
||||||
|
m.logDebug("Sandbox manager initialized (HTTP proxy: %d, SOCKS proxy: %d)", m.httpPort, m.socksPort)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// WrapCommand wraps a command with sandbox restrictions.
|
||||||
|
func (m *Manager) WrapCommand(command string) (string, error) {
|
||||||
|
if !m.initialized {
|
||||||
|
if err := m.Initialize(); err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
plat := platform.Detect()
|
||||||
|
switch plat {
|
||||||
|
case platform.MacOS:
|
||||||
|
return WrapCommandMacOS(m.config, command, m.httpPort, m.socksPort, m.exposedPorts, m.debug)
|
||||||
|
case platform.Linux:
|
||||||
|
return WrapCommandLinux(m.config, command, m.linuxBridge, m.reverseBridge, m.debug)
|
||||||
|
default:
|
||||||
|
return "", fmt.Errorf("unsupported platform: %s", plat)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Cleanup stops the proxies and cleans up resources.
|
||||||
|
func (m *Manager) Cleanup() {
|
||||||
|
if m.reverseBridge != nil {
|
||||||
|
m.reverseBridge.Cleanup()
|
||||||
|
}
|
||||||
|
if m.linuxBridge != nil {
|
||||||
|
m.linuxBridge.Cleanup()
|
||||||
|
}
|
||||||
|
if m.httpProxy != nil {
|
||||||
|
m.httpProxy.Stop()
|
||||||
|
}
|
||||||
|
if m.socksProxy != nil {
|
||||||
|
m.socksProxy.Stop()
|
||||||
|
}
|
||||||
|
m.logDebug("Sandbox manager cleaned up")
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *Manager) logDebug(format string, args ...interface{}) {
|
||||||
|
if m.debug {
|
||||||
|
fmt.Fprintf(os.Stderr, "[fence] "+format+"\n", args...)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// HTTPPort returns the HTTP proxy port.
|
||||||
|
func (m *Manager) HTTPPort() int {
|
||||||
|
return m.httpPort
|
||||||
|
}
|
||||||
|
|
||||||
|
// SOCKSPort returns the SOCKS proxy port.
|
||||||
|
func (m *Manager) SOCKSPort() int {
|
||||||
|
return m.socksPort
|
||||||
|
}
|
||||||
125
internal/sandbox/utils.go
Normal file
125
internal/sandbox/utils.go
Normal file
@@ -0,0 +1,125 @@
|
|||||||
|
package sandbox
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/base64"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
// ContainsGlobChars checks if a path pattern contains glob characters.
|
||||||
|
func ContainsGlobChars(pattern string) bool {
|
||||||
|
return strings.ContainsAny(pattern, "*?[]")
|
||||||
|
}
|
||||||
|
|
||||||
|
// RemoveTrailingGlobSuffix removes trailing /** from a path pattern.
|
||||||
|
func RemoveTrailingGlobSuffix(pattern string) string {
|
||||||
|
return strings.TrimSuffix(pattern, "/**")
|
||||||
|
}
|
||||||
|
|
||||||
|
// NormalizePath normalizes a path for sandbox configuration.
|
||||||
|
// Handles tilde expansion and relative paths.
|
||||||
|
func NormalizePath(pathPattern string) string {
|
||||||
|
home, _ := os.UserHomeDir()
|
||||||
|
cwd, _ := os.Getwd()
|
||||||
|
|
||||||
|
normalized := pathPattern
|
||||||
|
|
||||||
|
// Expand ~ to home directory
|
||||||
|
if pathPattern == "~" {
|
||||||
|
normalized = home
|
||||||
|
} else if strings.HasPrefix(pathPattern, "~/") {
|
||||||
|
normalized = filepath.Join(home, pathPattern[2:])
|
||||||
|
} else if strings.HasPrefix(pathPattern, "./") || strings.HasPrefix(pathPattern, "../") {
|
||||||
|
normalized, _ = filepath.Abs(filepath.Join(cwd, pathPattern))
|
||||||
|
} else if !filepath.IsAbs(pathPattern) && !ContainsGlobChars(pathPattern) {
|
||||||
|
normalized, _ = filepath.Abs(filepath.Join(cwd, pathPattern))
|
||||||
|
}
|
||||||
|
|
||||||
|
// For non-glob patterns, try to resolve symlinks
|
||||||
|
if !ContainsGlobChars(normalized) {
|
||||||
|
if resolved, err := filepath.EvalSymlinks(normalized); err == nil {
|
||||||
|
return resolved
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return normalized
|
||||||
|
}
|
||||||
|
|
||||||
|
// GenerateProxyEnvVars creates environment variables for proxy configuration.
|
||||||
|
func GenerateProxyEnvVars(httpPort, socksPort int) []string {
|
||||||
|
envVars := []string{
|
||||||
|
"FENCE_SANDBOX=1",
|
||||||
|
"TMPDIR=/tmp/fence",
|
||||||
|
}
|
||||||
|
|
||||||
|
if httpPort == 0 && socksPort == 0 {
|
||||||
|
return envVars
|
||||||
|
}
|
||||||
|
|
||||||
|
// NO_PROXY for localhost and private networks
|
||||||
|
noProxy := strings.Join([]string{
|
||||||
|
"localhost",
|
||||||
|
"127.0.0.1",
|
||||||
|
"::1",
|
||||||
|
"*.local",
|
||||||
|
".local",
|
||||||
|
"169.254.0.0/16",
|
||||||
|
"10.0.0.0/8",
|
||||||
|
"172.16.0.0/12",
|
||||||
|
"192.168.0.0/16",
|
||||||
|
}, ",")
|
||||||
|
|
||||||
|
envVars = append(envVars,
|
||||||
|
"NO_PROXY="+noProxy,
|
||||||
|
"no_proxy="+noProxy,
|
||||||
|
)
|
||||||
|
|
||||||
|
if httpPort > 0 {
|
||||||
|
proxyURL := "http://localhost:" + itoa(httpPort)
|
||||||
|
envVars = append(envVars,
|
||||||
|
"HTTP_PROXY="+proxyURL,
|
||||||
|
"HTTPS_PROXY="+proxyURL,
|
||||||
|
"http_proxy="+proxyURL,
|
||||||
|
"https_proxy="+proxyURL,
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
if socksPort > 0 {
|
||||||
|
socksURL := "socks5h://localhost:" + itoa(socksPort)
|
||||||
|
envVars = append(envVars,
|
||||||
|
"ALL_PROXY="+socksURL,
|
||||||
|
"all_proxy="+socksURL,
|
||||||
|
"FTP_PROXY="+socksURL,
|
||||||
|
"ftp_proxy="+socksURL,
|
||||||
|
)
|
||||||
|
// Git SSH through SOCKS
|
||||||
|
envVars = append(envVars,
|
||||||
|
"GIT_SSH_COMMAND=ssh -o ProxyCommand='nc -X 5 -x localhost:"+itoa(socksPort)+" %h %p'",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
return envVars
|
||||||
|
}
|
||||||
|
|
||||||
|
// EncodeSandboxedCommand encodes a command for sandbox monitoring.
|
||||||
|
func EncodeSandboxedCommand(command string) string {
|
||||||
|
if len(command) > 100 {
|
||||||
|
command = command[:100]
|
||||||
|
}
|
||||||
|
return base64.StdEncoding.EncodeToString([]byte(command))
|
||||||
|
}
|
||||||
|
|
||||||
|
// DecodeSandboxedCommand decodes a base64-encoded command.
|
||||||
|
func DecodeSandboxedCommand(encoded string) (string, error) {
|
||||||
|
data, err := base64.StdEncoding.DecodeString(encoded)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
return string(data), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func itoa(n int) string {
|
||||||
|
return strconv.Itoa(n)
|
||||||
|
}
|
||||||
39
pkg/fence/fence.go
Normal file
39
pkg/fence/fence.go
Normal file
@@ -0,0 +1,39 @@
|
|||||||
|
// Package fence provides a public API for sandboxing commands.
|
||||||
|
package fence
|
||||||
|
|
||||||
|
import (
|
||||||
|
"github.com/Use-Tusk/fence/internal/config"
|
||||||
|
"github.com/Use-Tusk/fence/internal/sandbox"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Config is the configuration for fence.
|
||||||
|
type Config = config.Config
|
||||||
|
|
||||||
|
// NetworkConfig defines network restrictions.
|
||||||
|
type NetworkConfig = config.NetworkConfig
|
||||||
|
|
||||||
|
// FilesystemConfig defines filesystem restrictions.
|
||||||
|
type FilesystemConfig = config.FilesystemConfig
|
||||||
|
|
||||||
|
// Manager handles sandbox initialization and command wrapping.
|
||||||
|
type Manager = sandbox.Manager
|
||||||
|
|
||||||
|
// NewManager creates a new sandbox manager.
|
||||||
|
func NewManager(cfg *Config, debug bool) *Manager {
|
||||||
|
return sandbox.NewManager(cfg, debug)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultConfig returns the default configuration with all network blocked.
|
||||||
|
func DefaultConfig() *Config {
|
||||||
|
return config.Default()
|
||||||
|
}
|
||||||
|
|
||||||
|
// LoadConfig loads configuration from a file.
|
||||||
|
func LoadConfig(path string) (*Config, error) {
|
||||||
|
return config.Load(path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DefaultConfigPath returns the default config file path.
|
||||||
|
func DefaultConfigPath() string {
|
||||||
|
return config.DefaultConfigPath()
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user