greywall

Archived

Author	SHA1	Message	Date
Mathieu Virbel	c19370f8b3	feat: deny-by-default filesystem isolation Some checks failed Build and test / Lint (push) Failing after 1m16s Details Build and test / Build (push) Successful in 13s Details Build and test / Test (Linux) (push) Failing after 41s Details Build and test / Test (macOS) (push) Has been cancelled Details - Deny-by-default filesystem isolation for Linux (Landlock) and macOS (Seatbelt) - Prevent learning mode from collapsing read paths to $HOME - Add Linux deny-by-default lessons to experience docs	2026-02-13 11:39:18 -06:00
Mathieu Virbel	3dd772d35a	feat: add --learning mode, --template flag, and fix DNS relay Some checks failed Build and test / Lint (push) Failing after 1m29s Details Build and test / Build (push) Successful in 13s Details Build and test / Test (Linux) (push) Failing after 58s Details Build and test / Test (macOS) (push) Has been cancelled Details Learning mode (--learning) traces filesystem access with strace and generates minimal sandbox config templates. A background monitor kills strace when the main command exits so long-lived child processes (LSP servers, file watchers) don't cause hangs. Other changes: - Add 'greywall templates list/show' subcommand - Add --template flag to load specific learned templates - Fix DNS relay: use TCP DNS (options use-vc) instead of broken UDP relay through tun2socks - Filter O_DIRECTORY opens from learned read paths - Add docs/experience.md with development notes	2026-02-11 08:22:53 -06:00

2 Commits