mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-04 08:25:55 +08:00
Alexander Watson
d7f1f8052d
Integrate Z3-based formal verification for sandbox policies as openshell.prover. Detects data exfiltration paths, write bypass attacks, L7 enforcement gaps, overpermissive methods, and privilege escalation via binary capability chains. Closes #699 Signed-off-by: Alexander Watson <zredlined@gmail.com>
26 lines
939 B
YAML
26 lines
939 B
YAML
binary: /usr/bin/git
|
|
description: "Distributed version control system"
|
|
protocols:
|
|
- name: git-smart-http
|
|
transport: https
|
|
description: "Git smart HTTP protocol over HTTPS CONNECT tunnel — not REST, bypasses L7 HTTP inspection"
|
|
bypasses_l7: true
|
|
actions:
|
|
- { name: clone, type: read, description: "Clone/fetch repository" }
|
|
- { name: push, type: write, description: "Push commits to remote" }
|
|
- { name: force_push, type: destructive, description: "Force push, rewriting remote history" }
|
|
- name: git-ssh
|
|
transport: ssh
|
|
description: "Git over SSH"
|
|
bypasses_l7: true
|
|
actions:
|
|
- { name: clone, type: read }
|
|
- { name: push, type: write }
|
|
- { name: force_push, type: destructive }
|
|
spawns:
|
|
- /usr/lib/git-core/git-remote-https
|
|
- /usr/bin/ssh
|
|
can_exfiltrate: true
|
|
exfil_mechanism: "Commit data to repo and push, or encode in branch/tag names"
|
|
can_construct_http: false
|