This repository has been archived on 2026-03-13. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Mathieu Virbel c19370f8b3 feat: deny-by-default filesystem isolation ...

- Deny-by-default filesystem isolation for Linux (Landlock) and macOS (Seatbelt)
- Prevent learning mode from collapsing read paths to $HOME
- Add Linux deny-by-default lessons to experience docs

2026-02-13 11:39:18 -06:00

..

bin

Replace built-in proxies with tun2socks transparent proxying

2026-02-09 20:41:12 -06:00

benchmark_test.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

command_test.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

command.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

dangerous_test.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

dangerous.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

integration_linux_test.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

integration_macos_test.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

integration_test.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

learning_linux_test.go

feat: add --learning mode, --template flag, and fix DNS relay

2026-02-11 08:22:53 -06:00

learning_linux.go

feat: add --learning mode, --template flag, and fix DNS relay

2026-02-11 08:22:53 -06:00

learning_stub.go

feat: add --learning mode, --template flag, and fix DNS relay

2026-02-11 08:22:53 -06:00

learning_test.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

learning.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

linux_ebpf_stub.go

Add environment sanitization

2025-12-25 20:47:11 -08:00

linux_ebpf.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

linux_features_stub.go

feat: add dependency status to --version and document AppArmor userns fix

2026-02-11 19:31:24 -06:00

linux_features.go

feat: add dependency status to --version and document AppArmor userns fix

2026-02-11 19:31:24 -06:00

linux_landlock_stub.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

linux_landlock.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

linux_seccomp_stub.go

Add environment sanitization

2025-12-25 20:47:11 -08:00

linux_seccomp.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

linux_stub.go

feat: add --learning mode, --template flag, and fix DNS relay

2026-02-11 08:22:53 -06:00

linux_test.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

linux.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

macos_test.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

macos.go

feat: deny-by-default filesystem isolation

2026-02-13 11:39:18 -06:00

manager.go

feat: default to GreyHaven proxy and DNS infrastructure

2026-02-11 18:16:35 -06:00

monitor.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

sanitize_test.go

Add environment sanitization

2025-12-25 20:47:11 -08:00

sanitize.go

Add environment sanitization

2025-12-25 20:47:11 -08:00

shell.go

Add environment sanitization

2025-12-25 20:47:11 -08:00

tun2socks_embed_stub.go

Replace built-in proxies with tun2socks transparent proxying

2026-02-09 20:41:12 -06:00

tun2socks_embed.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

utils_test.go

rename Fence to Greywall as GreyHaven sandboxing component

2026-02-10 16:00:24 -06:00

utils.go

feat: add --learning mode, --template flag, and fix DNS relay

2026-02-11 08:22:53 -06:00