mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-12 11:33:51 +08:00
Alexander Watson
d7f1f8052d
Integrate Z3-based formal verification for sandbox policies as openshell.prover. Detects data exfiltration paths, write bypass attacks, L7 enforcement gaps, overpermissive methods, and privilege escalation via binary capability chains. Closes #699 Signed-off-by: Alexander Watson <zredlined@gmail.com>
16 lines
567 B
YAML
16 lines
567 B
YAML
binary: /usr/bin/ssh
|
|
description: "OpenSSH client"
|
|
protocols:
|
|
- name: ssh
|
|
transport: ssh
|
|
description: "SSH protocol — encrypted tunnel, can forward ports and transfer files"
|
|
bypasses_l7: true
|
|
actions:
|
|
- { name: connect, type: read, description: "SSH shell connection" }
|
|
- { name: tunnel, type: write, description: "Port forwarding / tunnel" }
|
|
- { name: scp, type: write, description: "File transfer via SCP" }
|
|
spawns: []
|
|
can_exfiltrate: true
|
|
exfil_mechanism: "SCP files or pipe data through SSH tunnel"
|
|
can_construct_http: false
|