mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-25 06:42:52 +08:00
Alexander Watson
d7f1f8052d
Integrate Z3-based formal verification for sandbox policies as openshell.prover. Detects data exfiltration paths, write bypass attacks, L7 enforcement gaps, overpermissive methods, and privilege escalation via binary capability chains. Closes #699 Signed-off-by: Alexander Watson <zredlined@gmail.com>
15 lines
243 B
YAML
15 lines
243 B
YAML
version: 1
|
|
|
|
filesystem_policy:
|
|
include_workdir: true
|
|
read_only:
|
|
- /usr
|
|
- /lib
|
|
- /etc
|
|
read_write:
|
|
- /sandbox
|
|
- /tmp
|
|
|
|
# Empty network policies — deny all external. Only inference.local reachable.
|
|
network_policies: {}
|