mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-25 06:42:52 +08:00
Alexander Watson
d7f1f8052d
Integrate Z3-based formal verification for sandbox policies as openshell.prover. Detects data exfiltration paths, write bypass attacks, L7 enforcement gaps, overpermissive methods, and privilege escalation via binary capability chains. Closes #699 Signed-off-by: Alexander Watson <zredlined@gmail.com>
22 lines
662 B
YAML
22 lines
662 B
YAML
binary: /usr/local/bin/python3.13
|
|
description: "Python interpreter — general-purpose runtime"
|
|
protocols:
|
|
- name: http-programmatic
|
|
transport: https
|
|
description: "Python can construct arbitrary HTTP requests via urllib, httpx, requests"
|
|
bypasses_l7: false
|
|
actions:
|
|
- { name: get, type: read }
|
|
- { name: post, type: write }
|
|
- { name: put, type: write }
|
|
- { name: delete, type: destructive }
|
|
spawns:
|
|
- /usr/bin/curl
|
|
- /usr/bin/git
|
|
- /usr/bin/ssh
|
|
- /usr/bin/nc
|
|
- /usr/bin/wget
|
|
can_exfiltrate: true
|
|
exfil_mechanism: "Construct arbitrary HTTP requests, write to files, spawn subprocesses"
|
|
can_construct_http: true
|