mirror of
https://github.com/openai/codex.git
synced 2026-02-01 22:47:52 +00:00
migrating execpolicy -> execpolicy-legacy and execpolicy2 -> execpolicy (#6956)
This commit is contained in:
zhao-oai
32
codex-rs/Cargo.lock
generated
32
codex-rs/Cargo.lock
generated
@@ -1086,7 +1086,7 @@ dependencies = [
|
||||
"codex-apply-patch",
|
||||
"codex-arg0",
|
||||
"codex-async-utils",
|
||||
"codex-execpolicy2",
|
||||
"codex-execpolicy",
|
||||
"codex-file-search",
|
||||
"codex-git",
|
||||
"codex-keyring-store",
|
||||
@@ -1209,6 +1209,21 @@ dependencies = [
|
||||
[[package]]
|
||||
name = "codex-execpolicy"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"clap",
|
||||
"multimap",
|
||||
"pretty_assertions",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"shlex",
|
||||
"starlark",
|
||||
"thiserror 2.0.17",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "codex-execpolicy-legacy"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"allocative",
|
||||
"anyhow",
|
||||
@@ -1226,21 +1241,6 @@ dependencies = [
|
||||
"tempfile",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "codex-execpolicy2"
|
||||
version = "0.0.0"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"clap",
|
||||
"multimap",
|
||||
"pretty_assertions",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"shlex",
|
||||
"starlark",
|
||||
"thiserror 2.0.17",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "codex-feedback"
|
||||
version = "0.0.0"
|
||||
|
||||
@@ -18,7 +18,7 @@ members = [
|
||||
"exec",
|
||||
"exec-server",
|
||||
"execpolicy",
|
||||
"execpolicy2",
|
||||
"execpolicy-legacy",
|
||||
"keyring-store",
|
||||
"file-search",
|
||||
"linux-sandbox",
|
||||
@@ -67,7 +67,7 @@ codex-chatgpt = { path = "chatgpt" }
|
||||
codex-common = { path = "common" }
|
||||
codex-core = { path = "core" }
|
||||
codex-exec = { path = "exec" }
|
||||
codex-execpolicy2 = { path = "execpolicy2" }
|
||||
codex-execpolicy = { path = "execpolicy" }
|
||||
codex-feedback = { path = "feedback" }
|
||||
codex-file-search = { path = "file-search" }
|
||||
codex-git = { path = "utils/git" }
|
||||
|
||||
@@ -22,7 +22,7 @@ chrono = { workspace = true, features = ["serde"] }
|
||||
codex-app-server-protocol = { workspace = true }
|
||||
codex-apply-patch = { workspace = true }
|
||||
codex-async-utils = { workspace = true }
|
||||
codex-execpolicy2 = { workspace = true }
|
||||
codex-execpolicy = { workspace = true }
|
||||
codex-file-search = { workspace = true }
|
||||
codex-git = { workspace = true }
|
||||
codex-keyring-store = { workspace = true }
|
||||
|
||||
@@ -121,7 +121,7 @@ use crate::user_instructions::UserInstructions;
|
||||
use crate::user_notification::UserNotification;
|
||||
use crate::util::backoff;
|
||||
use codex_async_utils::OrCancelExt;
|
||||
use codex_execpolicy2::Policy as ExecPolicy;
|
||||
use codex_execpolicy::Policy as ExecPolicy;
|
||||
use codex_otel::otel_event_manager::OtelEventManager;
|
||||
use codex_protocol::config_types::ReasoningEffort as ReasoningEffortConfig;
|
||||
use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;
|
||||
@@ -2616,7 +2616,7 @@ mod tests {
|
||||
cwd: config.cwd.clone(),
|
||||
original_config_do_not_use: Arc::clone(&config),
|
||||
features: Features::default(),
|
||||
exec_policy: Arc::new(codex_execpolicy2::Policy::empty()),
|
||||
exec_policy: Arc::new(ExecPolicy::empty()),
|
||||
session_source: SessionSource::Exec,
|
||||
};
|
||||
|
||||
@@ -2694,7 +2694,7 @@ mod tests {
|
||||
cwd: config.cwd.clone(),
|
||||
original_config_do_not_use: Arc::clone(&config),
|
||||
features: Features::default(),
|
||||
exec_policy: Arc::new(codex_execpolicy2::Policy::empty()),
|
||||
exec_policy: Arc::new(ExecPolicy::empty()),
|
||||
session_source: SessionSource::Exec,
|
||||
};
|
||||
|
||||
|
||||
@@ -4,10 +4,10 @@ use std::path::PathBuf;
|
||||
use std::sync::Arc;
|
||||
|
||||
use crate::command_safety::is_dangerous_command::requires_initial_appoval;
|
||||
use codex_execpolicy2::Decision;
|
||||
use codex_execpolicy2::Evaluation;
|
||||
use codex_execpolicy2::Policy;
|
||||
use codex_execpolicy2::PolicyParser;
|
||||
use codex_execpolicy::Decision;
|
||||
use codex_execpolicy::Evaluation;
|
||||
use codex_execpolicy::Policy;
|
||||
use codex_execpolicy::PolicyParser;
|
||||
use codex_protocol::protocol::AskForApproval;
|
||||
use codex_protocol::protocol::SandboxPolicy;
|
||||
use thiserror::Error;
|
||||
@@ -41,7 +41,7 @@ pub enum ExecPolicyError {
|
||||
#[error("failed to parse execpolicy file {path}: {source}")]
|
||||
ParsePolicy {
|
||||
path: String,
|
||||
source: codex_execpolicy2::Error,
|
||||
source: codex_execpolicy::Error,
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@@ -144,7 +144,7 @@ pub async fn main_execve_wrapper() -> anyhow::Result<()> {
|
||||
std::process::exit(exit_code);
|
||||
}
|
||||
|
||||
// TODO: replace with execpolicy2
|
||||
// TODO: replace with execpolicy
|
||||
|
||||
fn dummy_exec_policy(file: &Path, argv: &[String], _workdir: &Path) -> ExecPolicyOutcome {
|
||||
if file.ends_with("rm") {
|
||||
|
||||
34
codex-rs/execpolicy-legacy/Cargo.toml
Normal file
34
codex-rs/execpolicy-legacy/Cargo.toml
Normal file
@@ -0,0 +1,34 @@
|
||||
[package]
|
||||
edition = "2024"
|
||||
name = "codex-execpolicy-legacy"
|
||||
description = "Legacy exec policy engine for validating proposed exec calls."
|
||||
version = { workspace = true }
|
||||
|
||||
[[bin]]
|
||||
name = "codex-execpolicy-legacy"
|
||||
path = "src/main.rs"
|
||||
|
||||
[lib]
|
||||
name = "codex_execpolicy_legacy"
|
||||
path = "src/lib.rs"
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
allocative = { workspace = true }
|
||||
anyhow = { workspace = true }
|
||||
clap = { workspace = true, features = ["derive"] }
|
||||
derive_more = { workspace = true, features = ["display"] }
|
||||
env_logger = { workspace = true }
|
||||
log = { workspace = true }
|
||||
multimap = { workspace = true }
|
||||
path-absolutize = { workspace = true }
|
||||
regex-lite = { workspace = true }
|
||||
serde = { workspace = true, features = ["derive"] }
|
||||
serde_json = { workspace = true }
|
||||
serde_with = { workspace = true, features = ["macros"] }
|
||||
starlark = { workspace = true }
|
||||
|
||||
[dev-dependencies]
|
||||
tempfile = { workspace = true }
|
||||
183
codex-rs/execpolicy-legacy/README.md
Normal file
183
codex-rs/execpolicy-legacy/README.md
Normal file
@@ -0,0 +1,183 @@
|
||||
# codex-execpolicy-legacy
|
||||
|
||||
This crate hosts the original execpolicy implementation. The newer prefix-rule
|
||||
engine lives in `codex-execpolicy`.
|
||||
|
||||
The goal of this library is to classify a proposed [`execv(3)`](https://linux.die.net/man/3/execv) command into one of the following states:
|
||||
|
||||
- `safe` The command is safe to run (\*).
|
||||
- `match` The command matched a rule in the policy, but the caller should decide whether it is safe to run based on the files it will write.
|
||||
- `forbidden` The command is not allowed to be run.
|
||||
- `unverified` The safety cannot be determined: make the user decide.
|
||||
|
||||
(\*) Whether an `execv(3)` call should be considered "safe" often requires additional context beyond the arguments to `execv()` itself. For example, if you trust an autonomous software agent to write files in your source tree, then deciding whether `/bin/cp foo bar` is "safe" depends on `getcwd(3)` for the calling process as well as the `realpath` of `foo` and `bar` when resolved against `getcwd()`.
|
||||
To that end, rather than returning a boolean, the validator returns a structured result that the client is expected to use to determine the "safety" of the proposed `execv()` call.
|
||||
|
||||
For example, to check the command `ls -l foo`, the checker would be invoked as follows:
|
||||
|
||||
```shell
|
||||
cargo run -p codex-execpolicy-legacy -- check ls -l foo | jq
|
||||
```
|
||||
|
||||
It will exit with `0` and print the following to stdout:
|
||||
|
||||
```json
|
||||
{
|
||||
"result": "safe",
|
||||
"match": {
|
||||
"program": "ls",
|
||||
"flags": [
|
||||
{
|
||||
"name": "-l"
|
||||
}
|
||||
],
|
||||
"opts": [],
|
||||
"args": [
|
||||
{
|
||||
"index": 1,
|
||||
"type": "ReadableFile",
|
||||
"value": "foo"
|
||||
}
|
||||
],
|
||||
"system_path": ["/bin/ls", "/usr/bin/ls"]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Of note:
|
||||
|
||||
- `foo` is tagged as a `ReadableFile`, so the caller should resolve `foo` relative to `getcwd()` and `realpath` it (as it may be a symlink) to determine whether `foo` is safe to read.
|
||||
- While the specified executable is `ls`, `"system_path"` offers `/bin/ls` and `/usr/bin/ls` as viable alternatives to avoid using whatever `ls` happens to appear first on the user's `$PATH`. If either exists on the host, it is recommended to use it as the first argument to `execv(3)` instead of `ls`.
|
||||
|
||||
Further, "safety" in this system is not a guarantee that the command will execute successfully. As an example, `cat /Users/mbolin/code/codex/README.md` may be considered "safe" if the system has decided the agent is allowed to read anything under `/Users/mbolin/code/codex`, but it will fail at runtime if `README.md` does not exist. (Though this is "safe" in that the agent did not read any files that it was not authorized to read.)
|
||||
|
||||
## Policy
|
||||
|
||||
Currently, the default policy is defined in [`default.policy`](./src/default.policy) within the crate.
|
||||
|
||||
The system uses [Starlark](https://bazel.build/rules/language) as the file format because, unlike something like JSON or YAML, it supports "macros" without compromising on safety or reproducibility. (Under the hood, we use [`starlark-rust`](https://github.com/facebook/starlark-rust) as the specific Starlark implementation.)
|
||||
|
||||
This policy contains "rules" such as:
|
||||
|
||||
```python
|
||||
define_program(
|
||||
program="cp",
|
||||
options=[
|
||||
flag("-r"),
|
||||
flag("-R"),
|
||||
flag("--recursive"),
|
||||
],
|
||||
args=[ARG_RFILES, ARG_WFILE],
|
||||
system_path=["/bin/cp", "/usr/bin/cp"],
|
||||
should_match=[
|
||||
["foo", "bar"],
|
||||
],
|
||||
should_not_match=[
|
||||
["foo"],
|
||||
],
|
||||
)
|
||||
```
|
||||
|
||||
This rule means that:
|
||||
|
||||
- `cp` can be used with any of the following flags (where "flag" means "an option that does not take an argument"): `-r`, `-R`, `--recursive`.
|
||||
- The initial `ARG_RFILES` passed to `args` means that it expects one or more arguments that correspond to "readable files"
|
||||
- The final `ARG_WFILE` passed to `args` means that it expects exactly one argument that corresponds to a "writeable file."
|
||||
- As a means of a lightweight way of including a unit test alongside the definition, the `should_match` list is a list of examples of `execv(3)` args that should match the rule and `should_not_match` is a list of examples that should not match. These examples are verified when the `.policy` file is loaded.
|
||||
|
||||
Note that the language of the `.policy` file is still evolving, as we have to continue to expand it so it is sufficiently expressive to accept all commands we want to consider "safe" without allowing unsafe commands to pass through.
|
||||
|
||||
The integrity of `default.policy` is verified [via unit tests](./tests).
|
||||
|
||||
Further, the CLI supports a `--policy` option to specify a custom `.policy` file for ad-hoc testing.
|
||||
|
||||
## Output Type: `match`
|
||||
|
||||
Going back to the `cp` example, because the rule matches an `ARG_WFILE`, it will return `match` instead of `safe`:
|
||||
|
||||
```shell
|
||||
cargo run -p codex-execpolicy-legacy -- check cp src1 src2 dest | jq
|
||||
```
|
||||
|
||||
If the caller wants to consider allowing this command, it should parse the JSON to pick out the `WriteableFile` arguments and decide whether they are safe to write:
|
||||
|
||||
```json
|
||||
{
|
||||
"result": "match",
|
||||
"match": {
|
||||
"program": "cp",
|
||||
"flags": [],
|
||||
"opts": [],
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"type": "ReadableFile",
|
||||
"value": "src1"
|
||||
},
|
||||
{
|
||||
"index": 1,
|
||||
"type": "ReadableFile",
|
||||
"value": "src2"
|
||||
},
|
||||
{
|
||||
"index": 2,
|
||||
"type": "WriteableFile",
|
||||
"value": "dest"
|
||||
}
|
||||
],
|
||||
"system_path": ["/bin/cp", "/usr/bin/cp"]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Note the exit code is still `0` for a `match` unless the `--require-safe` flag is specified, in which case the exit code is `12`.
|
||||
|
||||
## Output Type: `forbidden`
|
||||
|
||||
It is also possible to define a rule that, if it matches a command, should flag it as _forbidden_. For example, we do not want agents to be able to run `applied deploy` _ever_, so we define the following rule:
|
||||
|
||||
```python
|
||||
define_program(
|
||||
program="applied",
|
||||
args=["deploy"],
|
||||
forbidden="Infrastructure Risk: command contains 'applied deploy'",
|
||||
should_match=[
|
||||
["deploy"],
|
||||
],
|
||||
should_not_match=[
|
||||
["lint"],
|
||||
],
|
||||
)
|
||||
```
|
||||
|
||||
Note that for a rule to be forbidden, the `forbidden` keyword arg must be specified as the reason the command is forbidden. This will be included in the output:
|
||||
|
||||
```shell
|
||||
cargo run -p codex-execpolicy-legacy -- check applied deploy | jq
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"result": "forbidden",
|
||||
"reason": "Infrastructure Risk: command contains 'applied deploy'",
|
||||
"cause": {
|
||||
"Exec": {
|
||||
"exec": {
|
||||
"program": "applied",
|
||||
"flags": [],
|
||||
"opts": [],
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"type": {
|
||||
"Literal": "deploy"
|
||||
},
|
||||
"value": "deploy"
|
||||
}
|
||||
],
|
||||
"system_path": []
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
96
codex-rs/execpolicy-legacy/src/error.rs
Normal file
96
codex-rs/execpolicy-legacy/src/error.rs
Normal file
@@ -0,0 +1,96 @@
|
||||
use std::path::PathBuf;
|
||||
|
||||
use serde::Serialize;
|
||||
|
||||
use crate::arg_matcher::ArgMatcher;
|
||||
use crate::arg_resolver::PositionalArg;
|
||||
use serde_with::DisplayFromStr;
|
||||
use serde_with::serde_as;
|
||||
|
||||
pub type Result<T> = std::result::Result<T, Error>;
|
||||
|
||||
#[serde_as]
|
||||
#[derive(Debug, Eq, PartialEq, Serialize)]
|
||||
#[serde(tag = "type")]
|
||||
pub enum Error {
|
||||
NoSpecForProgram {
|
||||
program: String,
|
||||
},
|
||||
OptionMissingValue {
|
||||
program: String,
|
||||
option: String,
|
||||
},
|
||||
OptionFollowedByOptionInsteadOfValue {
|
||||
program: String,
|
||||
option: String,
|
||||
value: String,
|
||||
},
|
||||
UnknownOption {
|
||||
program: String,
|
||||
option: String,
|
||||
},
|
||||
UnexpectedArguments {
|
||||
program: String,
|
||||
args: Vec<PositionalArg>,
|
||||
},
|
||||
DoubleDashNotSupportedYet {
|
||||
program: String,
|
||||
},
|
||||
MultipleVarargPatterns {
|
||||
program: String,
|
||||
first: ArgMatcher,
|
||||
second: ArgMatcher,
|
||||
},
|
||||
RangeStartExceedsEnd {
|
||||
start: usize,
|
||||
end: usize,
|
||||
},
|
||||
RangeEndOutOfBounds {
|
||||
end: usize,
|
||||
len: usize,
|
||||
},
|
||||
PrefixOverlapsSuffix {},
|
||||
NotEnoughArgs {
|
||||
program: String,
|
||||
args: Vec<PositionalArg>,
|
||||
arg_patterns: Vec<ArgMatcher>,
|
||||
},
|
||||
InternalInvariantViolation {
|
||||
message: String,
|
||||
},
|
||||
VarargMatcherDidNotMatchAnything {
|
||||
program: String,
|
||||
matcher: ArgMatcher,
|
||||
},
|
||||
EmptyFileName {},
|
||||
LiteralValueDidNotMatch {
|
||||
expected: String,
|
||||
actual: String,
|
||||
},
|
||||
InvalidPositiveInteger {
|
||||
value: String,
|
||||
},
|
||||
MissingRequiredOptions {
|
||||
program: String,
|
||||
options: Vec<String>,
|
||||
},
|
||||
SedCommandNotProvablySafe {
|
||||
command: String,
|
||||
},
|
||||
ReadablePathNotInReadableFolders {
|
||||
file: PathBuf,
|
||||
folders: Vec<PathBuf>,
|
||||
},
|
||||
WriteablePathNotInWriteableFolders {
|
||||
file: PathBuf,
|
||||
folders: Vec<PathBuf>,
|
||||
},
|
||||
CannotCheckRelativePath {
|
||||
file: PathBuf,
|
||||
},
|
||||
CannotCanonicalizePath {
|
||||
file: String,
|
||||
#[serde_as(as = "DisplayFromStr")]
|
||||
error: std::io::ErrorKind,
|
||||
},
|
||||
}
|
||||
45
codex-rs/execpolicy-legacy/src/lib.rs
Normal file
45
codex-rs/execpolicy-legacy/src/lib.rs
Normal file
@@ -0,0 +1,45 @@
|
||||
#![allow(clippy::type_complexity)]
|
||||
#![allow(clippy::too_many_arguments)]
|
||||
#[macro_use]
|
||||
extern crate starlark;
|
||||
|
||||
mod arg_matcher;
|
||||
mod arg_resolver;
|
||||
mod arg_type;
|
||||
mod error;
|
||||
mod exec_call;
|
||||
mod execv_checker;
|
||||
mod opt;
|
||||
mod policy;
|
||||
mod policy_parser;
|
||||
mod program;
|
||||
mod sed_command;
|
||||
mod valid_exec;
|
||||
|
||||
pub use arg_matcher::ArgMatcher;
|
||||
pub use arg_resolver::PositionalArg;
|
||||
pub use arg_type::ArgType;
|
||||
pub use error::Error;
|
||||
pub use error::Result;
|
||||
pub use exec_call::ExecCall;
|
||||
pub use execv_checker::ExecvChecker;
|
||||
pub use opt::Opt;
|
||||
pub use policy::Policy;
|
||||
pub use policy_parser::PolicyParser;
|
||||
pub use program::Forbidden;
|
||||
pub use program::MatchedExec;
|
||||
pub use program::NegativeExamplePassedCheck;
|
||||
pub use program::PositiveExampleFailedCheck;
|
||||
pub use program::ProgramSpec;
|
||||
pub use sed_command::parse_sed_command;
|
||||
pub use valid_exec::MatchedArg;
|
||||
pub use valid_exec::MatchedFlag;
|
||||
pub use valid_exec::MatchedOpt;
|
||||
pub use valid_exec::ValidExec;
|
||||
|
||||
const DEFAULT_POLICY: &str = include_str!("default.policy");
|
||||
|
||||
pub fn get_default_policy() -> starlark::Result<Policy> {
|
||||
let parser = PolicyParser::new("#default", DEFAULT_POLICY);
|
||||
parser.parse()
|
||||
}
|
||||
169
codex-rs/execpolicy-legacy/src/main.rs
Normal file
169
codex-rs/execpolicy-legacy/src/main.rs
Normal file
@@ -0,0 +1,169 @@
|
||||
use anyhow::Result;
|
||||
use clap::Parser;
|
||||
use clap::Subcommand;
|
||||
use codex_execpolicy_legacy::ExecCall;
|
||||
use codex_execpolicy_legacy::MatchedExec;
|
||||
use codex_execpolicy_legacy::Policy;
|
||||
use codex_execpolicy_legacy::PolicyParser;
|
||||
use codex_execpolicy_legacy::ValidExec;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
use serde::Deserialize;
|
||||
use serde::Serialize;
|
||||
use serde::de;
|
||||
use starlark::Error as StarlarkError;
|
||||
use std::path::PathBuf;
|
||||
use std::str::FromStr;
|
||||
|
||||
const MATCHED_BUT_WRITES_FILES_EXIT_CODE: i32 = 12;
|
||||
const MIGHT_BE_SAFE_EXIT_CODE: i32 = 13;
|
||||
const FORBIDDEN_EXIT_CODE: i32 = 14;
|
||||
|
||||
#[derive(Parser, Deserialize, Debug)]
|
||||
#[command(version, about, long_about = None)]
|
||||
pub struct Args {
|
||||
/// If the command fails the policy, exit with 13, but print parseable JSON
|
||||
/// to stdout.
|
||||
#[clap(long)]
|
||||
pub require_safe: bool,
|
||||
|
||||
/// Path to the policy file.
|
||||
#[clap(long, short = 'p')]
|
||||
pub policy: Option<PathBuf>,
|
||||
|
||||
#[command(subcommand)]
|
||||
pub command: Command,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize, Subcommand)]
|
||||
pub enum Command {
|
||||
/// Checks the command as if the arguments were the inputs to execv(3).
|
||||
Check {
|
||||
#[arg(trailing_var_arg = true)]
|
||||
command: Vec<String>,
|
||||
},
|
||||
|
||||
/// Checks the command encoded as a JSON object.
|
||||
#[clap(name = "check-json")]
|
||||
CheckJson {
|
||||
/// JSON object with "program" (str) and "args" (list[str]) fields.
|
||||
#[serde(deserialize_with = "deserialize_from_json")]
|
||||
exec: ExecArg,
|
||||
},
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
pub struct ExecArg {
|
||||
pub program: String,
|
||||
|
||||
#[serde(default)]
|
||||
pub args: Vec<String>,
|
||||
}
|
||||
|
||||
fn main() -> Result<()> {
|
||||
env_logger::init();
|
||||
|
||||
let args = Args::parse();
|
||||
let policy = match args.policy {
|
||||
Some(policy) => {
|
||||
let policy_source = policy.to_string_lossy().to_string();
|
||||
let unparsed_policy = std::fs::read_to_string(policy)?;
|
||||
let parser = PolicyParser::new(&policy_source, &unparsed_policy);
|
||||
parser.parse()
|
||||
}
|
||||
None => get_default_policy(),
|
||||
};
|
||||
let policy = policy.map_err(StarlarkError::into_anyhow)?;
|
||||
|
||||
let exec = match args.command {
|
||||
Command::Check { command } => match command.split_first() {
|
||||
Some((first, rest)) => ExecArg {
|
||||
program: first.to_string(),
|
||||
args: rest.to_vec(),
|
||||
},
|
||||
None => {
|
||||
eprintln!("no command provided");
|
||||
std::process::exit(1);
|
||||
}
|
||||
},
|
||||
Command::CheckJson { exec } => exec,
|
||||
};
|
||||
|
||||
let (output, exit_code) = check_command(&policy, exec, args.require_safe);
|
||||
let json = serde_json::to_string(&output)?;
|
||||
println!("{json}");
|
||||
std::process::exit(exit_code);
|
||||
}
|
||||
|
||||
fn check_command(
|
||||
policy: &Policy,
|
||||
ExecArg { program, args }: ExecArg,
|
||||
check: bool,
|
||||
) -> (Output, i32) {
|
||||
let exec_call = ExecCall { program, args };
|
||||
match policy.check(&exec_call) {
|
||||
Ok(MatchedExec::Match { exec }) => {
|
||||
if exec.might_write_files() {
|
||||
let exit_code = if check {
|
||||
MATCHED_BUT_WRITES_FILES_EXIT_CODE
|
||||
} else {
|
||||
0
|
||||
};
|
||||
(Output::Match { r#match: exec }, exit_code)
|
||||
} else {
|
||||
(Output::Safe { r#match: exec }, 0)
|
||||
}
|
||||
}
|
||||
Ok(MatchedExec::Forbidden { reason, cause }) => {
|
||||
let exit_code = if check { FORBIDDEN_EXIT_CODE } else { 0 };
|
||||
(Output::Forbidden { reason, cause }, exit_code)
|
||||
}
|
||||
Err(err) => {
|
||||
let exit_code = if check { MIGHT_BE_SAFE_EXIT_CODE } else { 0 };
|
||||
(Output::Unverified { error: err }, exit_code)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Serialize)]
|
||||
#[serde(tag = "result")]
|
||||
pub enum Output {
|
||||
/// The command is verified as safe.
|
||||
#[serde(rename = "safe")]
|
||||
Safe { r#match: ValidExec },
|
||||
|
||||
/// The command has matched a rule in the policy, but the caller should
|
||||
/// decide whether it is "safe" given the files it wants to write.
|
||||
#[serde(rename = "match")]
|
||||
Match { r#match: ValidExec },
|
||||
|
||||
/// The user is forbidden from running the command.
|
||||
#[serde(rename = "forbidden")]
|
||||
Forbidden {
|
||||
reason: String,
|
||||
cause: codex_execpolicy_legacy::Forbidden,
|
||||
},
|
||||
|
||||
/// The safety of the command could not be verified.
|
||||
#[serde(rename = "unverified")]
|
||||
Unverified {
|
||||
error: codex_execpolicy_legacy::Error,
|
||||
},
|
||||
}
|
||||
|
||||
fn deserialize_from_json<'de, D>(deserializer: D) -> Result<ExecArg, D::Error>
|
||||
where
|
||||
D: de::Deserializer<'de>,
|
||||
{
|
||||
let s = String::deserialize(deserializer)?;
|
||||
let decoded = serde_json::from_str(&s)
|
||||
.map_err(|e| serde::de::Error::custom(format!("JSON parse error: {e}")))?;
|
||||
Ok(decoded)
|
||||
}
|
||||
|
||||
impl FromStr for ExecArg {
|
||||
type Err = anyhow::Error;
|
||||
|
||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||
serde_json::from_str(s).map_err(Into::into)
|
||||
}
|
||||
}
|
||||
103
codex-rs/execpolicy-legacy/src/policy.rs
Normal file
103
codex-rs/execpolicy-legacy/src/policy.rs
Normal file
@@ -0,0 +1,103 @@
|
||||
use multimap::MultiMap;
|
||||
use regex_lite::Error as RegexError;
|
||||
use regex_lite::Regex;
|
||||
|
||||
use crate::ExecCall;
|
||||
use crate::Forbidden;
|
||||
use crate::MatchedExec;
|
||||
use crate::NegativeExamplePassedCheck;
|
||||
use crate::ProgramSpec;
|
||||
use crate::error::Error;
|
||||
use crate::error::Result;
|
||||
use crate::policy_parser::ForbiddenProgramRegex;
|
||||
use crate::program::PositiveExampleFailedCheck;
|
||||
|
||||
pub struct Policy {
|
||||
programs: MultiMap<String, ProgramSpec>,
|
||||
forbidden_program_regexes: Vec<ForbiddenProgramRegex>,
|
||||
forbidden_substrings_pattern: Option<Regex>,
|
||||
}
|
||||
|
||||
impl Policy {
|
||||
pub fn new(
|
||||
programs: MultiMap<String, ProgramSpec>,
|
||||
forbidden_program_regexes: Vec<ForbiddenProgramRegex>,
|
||||
forbidden_substrings: Vec<String>,
|
||||
) -> std::result::Result<Self, RegexError> {
|
||||
let forbidden_substrings_pattern = if forbidden_substrings.is_empty() {
|
||||
None
|
||||
} else {
|
||||
let escaped_substrings = forbidden_substrings
|
||||
.iter()
|
||||
.map(|s| regex_lite::escape(s))
|
||||
.collect::<Vec<_>>()
|
||||
.join("|");
|
||||
Some(Regex::new(&format!("({escaped_substrings})"))?)
|
||||
};
|
||||
Ok(Self {
|
||||
programs,
|
||||
forbidden_program_regexes,
|
||||
forbidden_substrings_pattern,
|
||||
})
|
||||
}
|
||||
|
||||
pub fn check(&self, exec_call: &ExecCall) -> Result<MatchedExec> {
|
||||
let ExecCall { program, args } = &exec_call;
|
||||
for ForbiddenProgramRegex { regex, reason } in &self.forbidden_program_regexes {
|
||||
if regex.is_match(program) {
|
||||
return Ok(MatchedExec::Forbidden {
|
||||
cause: Forbidden::Program {
|
||||
program: program.clone(),
|
||||
exec_call: exec_call.clone(),
|
||||
},
|
||||
reason: reason.clone(),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
for arg in args {
|
||||
if let Some(regex) = &self.forbidden_substrings_pattern
|
||||
&& regex.is_match(arg)
|
||||
{
|
||||
return Ok(MatchedExec::Forbidden {
|
||||
cause: Forbidden::Arg {
|
||||
arg: arg.clone(),
|
||||
exec_call: exec_call.clone(),
|
||||
},
|
||||
reason: format!("arg `{arg}` contains forbidden substring"),
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
let mut last_err = Err(Error::NoSpecForProgram {
|
||||
program: program.clone(),
|
||||
});
|
||||
if let Some(spec_list) = self.programs.get_vec(program) {
|
||||
for spec in spec_list {
|
||||
match spec.check(exec_call) {
|
||||
Ok(matched_exec) => return Ok(matched_exec),
|
||||
Err(err) => {
|
||||
last_err = Err(err);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
last_err
|
||||
}
|
||||
|
||||
pub fn check_each_good_list_individually(&self) -> Vec<PositiveExampleFailedCheck> {
|
||||
let mut violations = Vec::new();
|
||||
for (_program, spec) in self.programs.flat_iter() {
|
||||
violations.extend(spec.verify_should_match_list());
|
||||
}
|
||||
violations
|
||||
}
|
||||
|
||||
pub fn check_each_bad_list_individually(&self) -> Vec<NegativeExamplePassedCheck> {
|
||||
let mut violations = Vec::new();
|
||||
for (_program, spec) in self.programs.flat_iter() {
|
||||
violations.extend(spec.verify_should_not_match_list());
|
||||
}
|
||||
violations
|
||||
}
|
||||
}
|
||||
@@ -1,5 +1,5 @@
|
||||
use codex_execpolicy::NegativeExamplePassedCheck;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use codex_execpolicy_legacy::NegativeExamplePassedCheck;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
|
||||
#[test]
|
||||
fn verify_everything_in_bad_list_is_rejected() {
|
||||
@@ -1,15 +1,15 @@
|
||||
extern crate codex_execpolicy;
|
||||
extern crate codex_execpolicy_legacy;
|
||||
|
||||
use codex_execpolicy::ArgMatcher;
|
||||
use codex_execpolicy::ArgType;
|
||||
use codex_execpolicy::Error;
|
||||
use codex_execpolicy::ExecCall;
|
||||
use codex_execpolicy::MatchedArg;
|
||||
use codex_execpolicy::MatchedExec;
|
||||
use codex_execpolicy::Policy;
|
||||
use codex_execpolicy::Result;
|
||||
use codex_execpolicy::ValidExec;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use codex_execpolicy_legacy::ArgMatcher;
|
||||
use codex_execpolicy_legacy::ArgType;
|
||||
use codex_execpolicy_legacy::Error;
|
||||
use codex_execpolicy_legacy::ExecCall;
|
||||
use codex_execpolicy_legacy::MatchedArg;
|
||||
use codex_execpolicy_legacy::MatchedExec;
|
||||
use codex_execpolicy_legacy::Policy;
|
||||
use codex_execpolicy_legacy::Result;
|
||||
use codex_execpolicy_legacy::ValidExec;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
|
||||
#[expect(clippy::expect_used)]
|
||||
fn setup() -> Policy {
|
||||
@@ -1,5 +1,5 @@
|
||||
use codex_execpolicy::PositiveExampleFailedCheck;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use codex_execpolicy_legacy::PositiveExampleFailedCheck;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
|
||||
#[test]
|
||||
fn verify_everything_in_good_list_is_allowed() {
|
||||
@@ -1,16 +1,16 @@
|
||||
use codex_execpolicy::ArgMatcher;
|
||||
use codex_execpolicy::ArgType;
|
||||
use codex_execpolicy::Error;
|
||||
use codex_execpolicy::ExecCall;
|
||||
use codex_execpolicy::MatchedArg;
|
||||
use codex_execpolicy::MatchedExec;
|
||||
use codex_execpolicy::MatchedOpt;
|
||||
use codex_execpolicy::Policy;
|
||||
use codex_execpolicy::Result;
|
||||
use codex_execpolicy::ValidExec;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use codex_execpolicy_legacy::ArgMatcher;
|
||||
use codex_execpolicy_legacy::ArgType;
|
||||
use codex_execpolicy_legacy::Error;
|
||||
use codex_execpolicy_legacy::ExecCall;
|
||||
use codex_execpolicy_legacy::MatchedArg;
|
||||
use codex_execpolicy_legacy::MatchedExec;
|
||||
use codex_execpolicy_legacy::MatchedOpt;
|
||||
use codex_execpolicy_legacy::Policy;
|
||||
use codex_execpolicy_legacy::Result;
|
||||
use codex_execpolicy_legacy::ValidExec;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
|
||||
extern crate codex_execpolicy;
|
||||
extern crate codex_execpolicy_legacy;
|
||||
|
||||
#[expect(clippy::expect_used)]
|
||||
fn setup() -> Policy {
|
||||
@@ -1,13 +1,13 @@
|
||||
use codex_execpolicy::ArgType;
|
||||
use codex_execpolicy::Error;
|
||||
use codex_execpolicy::ExecCall;
|
||||
use codex_execpolicy::MatchedArg;
|
||||
use codex_execpolicy::MatchedExec;
|
||||
use codex_execpolicy::PolicyParser;
|
||||
use codex_execpolicy::Result;
|
||||
use codex_execpolicy::ValidExec;
|
||||
use codex_execpolicy_legacy::ArgType;
|
||||
use codex_execpolicy_legacy::Error;
|
||||
use codex_execpolicy_legacy::ExecCall;
|
||||
use codex_execpolicy_legacy::MatchedArg;
|
||||
use codex_execpolicy_legacy::MatchedExec;
|
||||
use codex_execpolicy_legacy::PolicyParser;
|
||||
use codex_execpolicy_legacy::Result;
|
||||
use codex_execpolicy_legacy::ValidExec;
|
||||
|
||||
extern crate codex_execpolicy;
|
||||
extern crate codex_execpolicy_legacy;
|
||||
|
||||
#[test]
|
||||
fn test_invalid_subcommand() -> Result<()> {
|
||||
@@ -1,15 +1,15 @@
|
||||
extern crate codex_execpolicy;
|
||||
extern crate codex_execpolicy_legacy;
|
||||
|
||||
use codex_execpolicy::ArgType;
|
||||
use codex_execpolicy::Error;
|
||||
use codex_execpolicy::ExecCall;
|
||||
use codex_execpolicy::MatchedArg;
|
||||
use codex_execpolicy::MatchedExec;
|
||||
use codex_execpolicy::MatchedFlag;
|
||||
use codex_execpolicy::Policy;
|
||||
use codex_execpolicy::Result;
|
||||
use codex_execpolicy::ValidExec;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use codex_execpolicy_legacy::ArgType;
|
||||
use codex_execpolicy_legacy::Error;
|
||||
use codex_execpolicy_legacy::ExecCall;
|
||||
use codex_execpolicy_legacy::MatchedArg;
|
||||
use codex_execpolicy_legacy::MatchedExec;
|
||||
use codex_execpolicy_legacy::MatchedFlag;
|
||||
use codex_execpolicy_legacy::Policy;
|
||||
use codex_execpolicy_legacy::Result;
|
||||
use codex_execpolicy_legacy::ValidExec;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
|
||||
#[expect(clippy::expect_used)]
|
||||
fn setup() -> Policy {
|
||||
@@ -1,5 +1,5 @@
|
||||
use codex_execpolicy::Error;
|
||||
use codex_execpolicy::parse_sed_command;
|
||||
use codex_execpolicy_legacy::Error;
|
||||
use codex_execpolicy_legacy::parse_sed_command;
|
||||
|
||||
#[test]
|
||||
fn parses_simple_print_command() {
|
||||
@@ -1,15 +1,15 @@
|
||||
extern crate codex_execpolicy;
|
||||
extern crate codex_execpolicy_legacy;
|
||||
|
||||
use std::vec;
|
||||
|
||||
use codex_execpolicy::Error;
|
||||
use codex_execpolicy::ExecCall;
|
||||
use codex_execpolicy::MatchedExec;
|
||||
use codex_execpolicy::MatchedFlag;
|
||||
use codex_execpolicy::Policy;
|
||||
use codex_execpolicy::PositionalArg;
|
||||
use codex_execpolicy::ValidExec;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use codex_execpolicy_legacy::Error;
|
||||
use codex_execpolicy_legacy::ExecCall;
|
||||
use codex_execpolicy_legacy::MatchedExec;
|
||||
use codex_execpolicy_legacy::MatchedFlag;
|
||||
use codex_execpolicy_legacy::Policy;
|
||||
use codex_execpolicy_legacy::PositionalArg;
|
||||
use codex_execpolicy_legacy::ValidExec;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
|
||||
#[expect(clippy::expect_used)]
|
||||
fn setup() -> Policy {
|
||||
@@ -1,16 +1,16 @@
|
||||
extern crate codex_execpolicy;
|
||||
extern crate codex_execpolicy_legacy;
|
||||
|
||||
use codex_execpolicy::ArgType;
|
||||
use codex_execpolicy::Error;
|
||||
use codex_execpolicy::ExecCall;
|
||||
use codex_execpolicy::MatchedArg;
|
||||
use codex_execpolicy::MatchedExec;
|
||||
use codex_execpolicy::MatchedFlag;
|
||||
use codex_execpolicy::MatchedOpt;
|
||||
use codex_execpolicy::Policy;
|
||||
use codex_execpolicy::Result;
|
||||
use codex_execpolicy::ValidExec;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use codex_execpolicy_legacy::ArgType;
|
||||
use codex_execpolicy_legacy::Error;
|
||||
use codex_execpolicy_legacy::ExecCall;
|
||||
use codex_execpolicy_legacy::MatchedArg;
|
||||
use codex_execpolicy_legacy::MatchedExec;
|
||||
use codex_execpolicy_legacy::MatchedFlag;
|
||||
use codex_execpolicy_legacy::MatchedOpt;
|
||||
use codex_execpolicy_legacy::Policy;
|
||||
use codex_execpolicy_legacy::Result;
|
||||
use codex_execpolicy_legacy::ValidExec;
|
||||
use codex_execpolicy_legacy::get_default_policy;
|
||||
|
||||
#[expect(clippy::expect_used)]
|
||||
fn setup() -> Policy {
|
||||
@@ -1,33 +1,29 @@
|
||||
[package]
|
||||
edition = "2024"
|
||||
name = "codex-execpolicy"
|
||||
version = { workspace = true }
|
||||
|
||||
[[bin]]
|
||||
name = "codex-execpolicy"
|
||||
path = "src/main.rs"
|
||||
edition = "2024"
|
||||
description = "Codex exec policy: prefix-based Starlark rules for command decisions."
|
||||
|
||||
[lib]
|
||||
name = "codex_execpolicy"
|
||||
path = "src/lib.rs"
|
||||
|
||||
[[bin]]
|
||||
name = "codex-execpolicy"
|
||||
path = "src/main.rs"
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
allocative = { workspace = true }
|
||||
anyhow = { workspace = true }
|
||||
clap = { workspace = true, features = ["derive"] }
|
||||
derive_more = { workspace = true, features = ["display"] }
|
||||
env_logger = { workspace = true }
|
||||
log = { workspace = true }
|
||||
multimap = { workspace = true }
|
||||
path-absolutize = { workspace = true }
|
||||
regex-lite = { workspace = true }
|
||||
serde = { workspace = true, features = ["derive"] }
|
||||
serde_json = { workspace = true }
|
||||
serde_with = { workspace = true, features = ["macros"] }
|
||||
shlex = { workspace = true }
|
||||
starlark = { workspace = true }
|
||||
thiserror = { workspace = true }
|
||||
|
||||
[dev-dependencies]
|
||||
tempfile = { workspace = true }
|
||||
pretty_assertions = { workspace = true }
|
||||
|
||||
@@ -1,180 +1,60 @@
|
||||
# codex_execpolicy
|
||||
# codex-execpolicy
|
||||
|
||||
The goal of this library is to classify a proposed [`execv(3)`](https://linux.die.net/man/3/execv) command into one of the following states:
|
||||
## Overview
|
||||
- Policy engine and CLI built around `prefix_rule(pattern=[...], decision?, match?, not_match?)`.
|
||||
- This release covers the prefix-rule subset of the execpolicy language; a richer language will follow.
|
||||
- Tokens are matched in order; any `pattern` element may be a list to denote alternatives. `decision` defaults to `allow`; valid values: `allow`, `prompt`, `forbidden`.
|
||||
- `match` / `not_match` supply example invocations that are validated at load time (think of them as unit tests); examples can be token arrays or strings (strings are tokenized with `shlex`).
|
||||
- The CLI always prints the JSON serialization of the evaluation result.
|
||||
- The legacy rule matcher lives in `codex-execpolicy-legacy`.
|
||||
|
||||
- `safe` The command is safe to run (\*).
|
||||
- `match` The command matched a rule in the policy, but the caller should decide whether it is safe to run based on the files it will write.
|
||||
- `forbidden` The command is not allowed to be run.
|
||||
- `unverified` The safety cannot be determined: make the user decide.
|
||||
|
||||
(\*) Whether an `execv(3)` call should be considered "safe" often requires additional context beyond the arguments to `execv()` itself. For example, if you trust an autonomous software agent to write files in your source tree, then deciding whether `/bin/cp foo bar` is "safe" depends on `getcwd(3)` for the calling process as well as the `realpath` of `foo` and `bar` when resolved against `getcwd()`.
|
||||
To that end, rather than returning a boolean, the validator returns a structured result that the client is expected to use to determine the "safety" of the proposed `execv()` call.
|
||||
|
||||
For example, to check the command `ls -l foo`, the checker would be invoked as follows:
|
||||
|
||||
```shell
|
||||
cargo run -- check ls -l foo | jq
|
||||
```
|
||||
|
||||
It will exit with `0` and print the following to stdout:
|
||||
|
||||
```json
|
||||
{
|
||||
"result": "safe",
|
||||
"match": {
|
||||
"program": "ls",
|
||||
"flags": [
|
||||
{
|
||||
"name": "-l"
|
||||
}
|
||||
],
|
||||
"opts": [],
|
||||
"args": [
|
||||
{
|
||||
"index": 1,
|
||||
"type": "ReadableFile",
|
||||
"value": "foo"
|
||||
}
|
||||
],
|
||||
"system_path": ["/bin/ls", "/usr/bin/ls"]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Of note:
|
||||
|
||||
- `foo` is tagged as a `ReadableFile`, so the caller should resolve `foo` relative to `getcwd()` and `realpath` it (as it may be a symlink) to determine whether `foo` is safe to read.
|
||||
- While the specified executable is `ls`, `"system_path"` offers `/bin/ls` and `/usr/bin/ls` as viable alternatives to avoid using whatever `ls` happens to appear first on the user's `$PATH`. If either exists on the host, it is recommended to use it as the first argument to `execv(3)` instead of `ls`.
|
||||
|
||||
Further, "safety" in this system is not a guarantee that the command will execute successfully. As an example, `cat /Users/mbolin/code/codex/README.md` may be considered "safe" if the system has decided the agent is allowed to read anything under `/Users/mbolin/code/codex`, but it will fail at runtime if `README.md` does not exist. (Though this is "safe" in that the agent did not read any files that it was not authorized to read.)
|
||||
|
||||
## Policy
|
||||
|
||||
Currently, the default policy is defined in [`default.policy`](./src/default.policy) within the crate.
|
||||
|
||||
The system uses [Starlark](https://bazel.build/rules/language) as the file format because, unlike something like JSON or YAML, it supports "macros" without compromising on safety or reproducibility. (Under the hood, we use [`starlark-rust`](https://github.com/facebook/starlark-rust) as the specific Starlark implementation.)
|
||||
|
||||
This policy contains "rules" such as:
|
||||
|
||||
```python
|
||||
define_program(
|
||||
program="cp",
|
||||
options=[
|
||||
flag("-r"),
|
||||
flag("-R"),
|
||||
flag("--recursive"),
|
||||
],
|
||||
args=[ARG_RFILES, ARG_WFILE],
|
||||
system_path=["/bin/cp", "/usr/bin/cp"],
|
||||
should_match=[
|
||||
["foo", "bar"],
|
||||
],
|
||||
should_not_match=[
|
||||
["foo"],
|
||||
],
|
||||
## Policy shapes
|
||||
- Prefix rules use Starlark syntax:
|
||||
```starlark
|
||||
prefix_rule(
|
||||
pattern = ["cmd", ["alt1", "alt2"]], # ordered tokens; list entries denote alternatives
|
||||
decision = "prompt", # allow | prompt | forbidden; defaults to allow
|
||||
match = [["cmd", "alt1"], "cmd alt2"], # examples that must match this rule
|
||||
not_match = [["cmd", "oops"], "cmd alt3"], # examples that must not match this rule
|
||||
)
|
||||
```
|
||||
|
||||
This rule means that:
|
||||
|
||||
- `cp` can be used with any of the following flags (where "flag" means "an option that does not take an argument"): `-r`, `-R`, `--recursive`.
|
||||
- The initial `ARG_RFILES` passed to `args` means that it expects one or more arguments that correspond to "readable files"
|
||||
- The final `ARG_WFILE` passed to `args` means that it expects exactly one argument that corresponds to a "writeable file."
|
||||
- As a means of a lightweight way of including a unit test alongside the definition, the `should_match` list is a list of examples of `execv(3)` args that should match the rule and `should_not_match` is a list of examples that should not match. These examples are verified when the `.policy` file is loaded.
|
||||
|
||||
Note that the language of the `.policy` file is still evolving, as we have to continue to expand it so it is sufficiently expressive to accept all commands we want to consider "safe" without allowing unsafe commands to pass through.
|
||||
|
||||
The integrity of `default.policy` is verified [via unit tests](./tests).
|
||||
|
||||
Further, the CLI supports a `--policy` option to specify a custom `.policy` file for ad-hoc testing.
|
||||
|
||||
## Output Type: `match`
|
||||
|
||||
Going back to the `cp` example, because the rule matches an `ARG_WFILE`, it will return `match` instead of `safe`:
|
||||
|
||||
```shell
|
||||
cargo run -- check cp src1 src2 dest | jq
|
||||
## CLI
|
||||
- Provide one or more policy files (for example `src/default.codexpolicy`) to check a command:
|
||||
```bash
|
||||
cargo run -p codex-execpolicy -- check --policy path/to/policy.codexpolicy git status
|
||||
```
|
||||
- Pass multiple `--policy` flags to merge rules, evaluated in the order provided:
|
||||
```bash
|
||||
cargo run -p codex-execpolicy -- check --policy base.codexpolicy --policy overrides.codexpolicy git status
|
||||
```
|
||||
- Output is JSON by default; pass `--pretty` for pretty-printed JSON
|
||||
- Example outcomes:
|
||||
- Match: `{"match": { ... "decision": "allow" ... }}`
|
||||
- No match: `"noMatch"`
|
||||
|
||||
If the caller wants to consider allowing this command, it should parse the JSON to pick out the `WriteableFile` arguments and decide whether they are safe to write:
|
||||
|
||||
## Response shapes
|
||||
- Match:
|
||||
```json
|
||||
{
|
||||
"result": "match",
|
||||
"match": {
|
||||
"program": "cp",
|
||||
"flags": [],
|
||||
"opts": [],
|
||||
"args": [
|
||||
"decision": "allow|prompt|forbidden",
|
||||
"matchedRules": [
|
||||
{
|
||||
"index": 0,
|
||||
"type": "ReadableFile",
|
||||
"value": "src1"
|
||||
},
|
||||
{
|
||||
"index": 1,
|
||||
"type": "ReadableFile",
|
||||
"value": "src2"
|
||||
},
|
||||
{
|
||||
"index": 2,
|
||||
"type": "WriteableFile",
|
||||
"value": "dest"
|
||||
"prefixRuleMatch": {
|
||||
"matchedPrefix": ["<token>", "..."],
|
||||
"decision": "allow|prompt|forbidden"
|
||||
}
|
||||
}
|
||||
],
|
||||
"system_path": ["/bin/cp", "/usr/bin/cp"]
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Note the exit code is still `0` for a `match` unless the `--require-safe` flag is specified, in which case the exit code is `12`.
|
||||
|
||||
## Output Type: `forbidden`
|
||||
|
||||
It is also possible to define a rule that, if it matches a command, should flag it as _forbidden_. For example, we do not want agents to be able to run `applied deploy` _ever_, so we define the following rule:
|
||||
|
||||
```python
|
||||
define_program(
|
||||
program="applied",
|
||||
args=["deploy"],
|
||||
forbidden="Infrastructure Risk: command contains 'applied deploy'",
|
||||
should_match=[
|
||||
["deploy"],
|
||||
],
|
||||
should_not_match=[
|
||||
["lint"],
|
||||
],
|
||||
)
|
||||
```
|
||||
|
||||
Note that for a rule to be forbidden, the `forbidden` keyword arg must be specified as the reason the command is forbidden. This will be included in the output:
|
||||
|
||||
```shell
|
||||
cargo run -- check applied deploy | jq
|
||||
```
|
||||
|
||||
- No match:
|
||||
```json
|
||||
{
|
||||
"result": "forbidden",
|
||||
"reason": "Infrastructure Risk: command contains 'applied deploy'",
|
||||
"cause": {
|
||||
"Exec": {
|
||||
"exec": {
|
||||
"program": "applied",
|
||||
"flags": [],
|
||||
"opts": [],
|
||||
"args": [
|
||||
{
|
||||
"index": 0,
|
||||
"type": {
|
||||
"Literal": "deploy"
|
||||
},
|
||||
"value": "deploy"
|
||||
}
|
||||
],
|
||||
"system_path": []
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
"noMatch"
|
||||
```
|
||||
|
||||
- `matchedRules` lists every rule whose prefix matched the command; `matchedPrefix` is the exact prefix that matched.
|
||||
- The effective `decision` is the strictest severity across all matches (`forbidden` > `prompt` > `allow`).
|
||||
|
||||
@@ -1,96 +1,26 @@
|
||||
use std::path::PathBuf;
|
||||
|
||||
use serde::Serialize;
|
||||
|
||||
use crate::arg_matcher::ArgMatcher;
|
||||
use crate::arg_resolver::PositionalArg;
|
||||
use serde_with::DisplayFromStr;
|
||||
use serde_with::serde_as;
|
||||
use starlark::Error as StarlarkError;
|
||||
use thiserror::Error;
|
||||
|
||||
pub type Result<T> = std::result::Result<T, Error>;
|
||||
|
||||
#[serde_as]
|
||||
#[derive(Debug, Eq, PartialEq, Serialize)]
|
||||
#[serde(tag = "type")]
|
||||
#[derive(Debug, Error)]
|
||||
pub enum Error {
|
||||
NoSpecForProgram {
|
||||
program: String,
|
||||
},
|
||||
OptionMissingValue {
|
||||
program: String,
|
||||
option: String,
|
||||
},
|
||||
OptionFollowedByOptionInsteadOfValue {
|
||||
program: String,
|
||||
option: String,
|
||||
value: String,
|
||||
},
|
||||
UnknownOption {
|
||||
program: String,
|
||||
option: String,
|
||||
},
|
||||
UnexpectedArguments {
|
||||
program: String,
|
||||
args: Vec<PositionalArg>,
|
||||
},
|
||||
DoubleDashNotSupportedYet {
|
||||
program: String,
|
||||
},
|
||||
MultipleVarargPatterns {
|
||||
program: String,
|
||||
first: ArgMatcher,
|
||||
second: ArgMatcher,
|
||||
},
|
||||
RangeStartExceedsEnd {
|
||||
start: usize,
|
||||
end: usize,
|
||||
},
|
||||
RangeEndOutOfBounds {
|
||||
end: usize,
|
||||
len: usize,
|
||||
},
|
||||
PrefixOverlapsSuffix {},
|
||||
NotEnoughArgs {
|
||||
program: String,
|
||||
args: Vec<PositionalArg>,
|
||||
arg_patterns: Vec<ArgMatcher>,
|
||||
},
|
||||
InternalInvariantViolation {
|
||||
message: String,
|
||||
},
|
||||
VarargMatcherDidNotMatchAnything {
|
||||
program: String,
|
||||
matcher: ArgMatcher,
|
||||
},
|
||||
EmptyFileName {},
|
||||
LiteralValueDidNotMatch {
|
||||
expected: String,
|
||||
actual: String,
|
||||
},
|
||||
InvalidPositiveInteger {
|
||||
value: String,
|
||||
},
|
||||
MissingRequiredOptions {
|
||||
program: String,
|
||||
options: Vec<String>,
|
||||
},
|
||||
SedCommandNotProvablySafe {
|
||||
command: String,
|
||||
},
|
||||
ReadablePathNotInReadableFolders {
|
||||
file: PathBuf,
|
||||
folders: Vec<PathBuf>,
|
||||
},
|
||||
WriteablePathNotInWriteableFolders {
|
||||
file: PathBuf,
|
||||
folders: Vec<PathBuf>,
|
||||
},
|
||||
CannotCheckRelativePath {
|
||||
file: PathBuf,
|
||||
},
|
||||
CannotCanonicalizePath {
|
||||
file: String,
|
||||
#[serde_as(as = "DisplayFromStr")]
|
||||
error: std::io::ErrorKind,
|
||||
#[error("invalid decision: {0}")]
|
||||
InvalidDecision(String),
|
||||
#[error("invalid pattern element: {0}")]
|
||||
InvalidPattern(String),
|
||||
#[error("invalid example: {0}")]
|
||||
InvalidExample(String),
|
||||
#[error(
|
||||
"expected every example to match at least one rule. rules: {rules:?}; unmatched examples: \
|
||||
{examples:?}"
|
||||
)]
|
||||
ExampleDidNotMatch {
|
||||
rules: Vec<String>,
|
||||
examples: Vec<String>,
|
||||
},
|
||||
#[error("expected example to not match rule `{rule}`: {example}")]
|
||||
ExampleDidMatch { rule: String, example: String },
|
||||
#[error("starlark error: {0}")]
|
||||
Starlark(StarlarkError),
|
||||
}
|
||||
|
||||
@@ -1,45 +1,15 @@
|
||||
#![allow(clippy::type_complexity)]
|
||||
#![allow(clippy::too_many_arguments)]
|
||||
#[macro_use]
|
||||
extern crate starlark;
|
||||
pub mod decision;
|
||||
pub mod error;
|
||||
pub mod parser;
|
||||
pub mod policy;
|
||||
pub mod rule;
|
||||
|
||||
mod arg_matcher;
|
||||
mod arg_resolver;
|
||||
mod arg_type;
|
||||
mod error;
|
||||
mod exec_call;
|
||||
mod execv_checker;
|
||||
mod opt;
|
||||
mod policy;
|
||||
mod policy_parser;
|
||||
mod program;
|
||||
mod sed_command;
|
||||
mod valid_exec;
|
||||
|
||||
pub use arg_matcher::ArgMatcher;
|
||||
pub use arg_resolver::PositionalArg;
|
||||
pub use arg_type::ArgType;
|
||||
pub use decision::Decision;
|
||||
pub use error::Error;
|
||||
pub use error::Result;
|
||||
pub use exec_call::ExecCall;
|
||||
pub use execv_checker::ExecvChecker;
|
||||
pub use opt::Opt;
|
||||
pub use parser::PolicyParser;
|
||||
pub use policy::Evaluation;
|
||||
pub use policy::Policy;
|
||||
pub use policy_parser::PolicyParser;
|
||||
pub use program::Forbidden;
|
||||
pub use program::MatchedExec;
|
||||
pub use program::NegativeExamplePassedCheck;
|
||||
pub use program::PositiveExampleFailedCheck;
|
||||
pub use program::ProgramSpec;
|
||||
pub use sed_command::parse_sed_command;
|
||||
pub use valid_exec::MatchedArg;
|
||||
pub use valid_exec::MatchedFlag;
|
||||
pub use valid_exec::MatchedOpt;
|
||||
pub use valid_exec::ValidExec;
|
||||
|
||||
const DEFAULT_POLICY: &str = include_str!("default.policy");
|
||||
|
||||
pub fn get_default_policy() -> starlark::Result<Policy> {
|
||||
let parser = PolicyParser::new("#default", DEFAULT_POLICY);
|
||||
parser.parse()
|
||||
}
|
||||
pub use rule::Rule;
|
||||
pub use rule::RuleMatch;
|
||||
pub use rule::RuleRef;
|
||||
|
||||
@@ -1,167 +1,66 @@
|
||||
use std::fs;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use anyhow::Context;
|
||||
use anyhow::Result;
|
||||
use clap::Parser;
|
||||
use clap::Subcommand;
|
||||
use codex_execpolicy::ExecCall;
|
||||
use codex_execpolicy::MatchedExec;
|
||||
use codex_execpolicy::Policy;
|
||||
use codex_execpolicy::PolicyParser;
|
||||
use codex_execpolicy::ValidExec;
|
||||
use codex_execpolicy::get_default_policy;
|
||||
use serde::Deserialize;
|
||||
use serde::Serialize;
|
||||
use serde::de;
|
||||
use starlark::Error as StarlarkError;
|
||||
use std::path::PathBuf;
|
||||
use std::str::FromStr;
|
||||
|
||||
const MATCHED_BUT_WRITES_FILES_EXIT_CODE: i32 = 12;
|
||||
const MIGHT_BE_SAFE_EXIT_CODE: i32 = 13;
|
||||
const FORBIDDEN_EXIT_CODE: i32 = 14;
|
||||
|
||||
#[derive(Parser, Deserialize, Debug)]
|
||||
#[command(version, about, long_about = None)]
|
||||
pub struct Args {
|
||||
/// If the command fails the policy, exit with 13, but print parseable JSON
|
||||
/// to stdout.
|
||||
#[clap(long)]
|
||||
pub require_safe: bool,
|
||||
|
||||
/// Path to the policy file.
|
||||
#[clap(long, short = 'p')]
|
||||
pub policy: Option<PathBuf>,
|
||||
|
||||
#[command(subcommand)]
|
||||
pub command: Command,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize, Subcommand)]
|
||||
pub enum Command {
|
||||
/// Checks the command as if the arguments were the inputs to execv(3).
|
||||
/// CLI for evaluating exec policies
|
||||
#[derive(Parser)]
|
||||
#[command(name = "codex-execpolicy")]
|
||||
enum Cli {
|
||||
/// Evaluate a command against a policy.
|
||||
Check {
|
||||
#[arg(trailing_var_arg = true)]
|
||||
#[arg(short, long = "policy", value_name = "PATH", required = true)]
|
||||
policies: Vec<PathBuf>,
|
||||
|
||||
/// Pretty-print the JSON output.
|
||||
#[arg(long)]
|
||||
pretty: bool,
|
||||
|
||||
/// Command tokens to check.
|
||||
#[arg(
|
||||
value_name = "COMMAND",
|
||||
required = true,
|
||||
trailing_var_arg = true,
|
||||
allow_hyphen_values = true
|
||||
)]
|
||||
command: Vec<String>,
|
||||
},
|
||||
|
||||
/// Checks the command encoded as a JSON object.
|
||||
#[clap(name = "check-json")]
|
||||
CheckJson {
|
||||
/// JSON object with "program" (str) and "args" (list[str]) fields.
|
||||
#[serde(deserialize_with = "deserialize_from_json")]
|
||||
exec: ExecArg,
|
||||
},
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
pub struct ExecArg {
|
||||
pub program: String,
|
||||
|
||||
#[serde(default)]
|
||||
pub args: Vec<String>,
|
||||
}
|
||||
|
||||
fn main() -> Result<()> {
|
||||
env_logger::init();
|
||||
let cli = Cli::parse();
|
||||
match cli {
|
||||
Cli::Check {
|
||||
policies,
|
||||
command,
|
||||
pretty,
|
||||
} => cmd_check(policies, command, pretty),
|
||||
}
|
||||
}
|
||||
|
||||
let args = Args::parse();
|
||||
let policy = match args.policy {
|
||||
Some(policy) => {
|
||||
let policy_source = policy.to_string_lossy().to_string();
|
||||
let unparsed_policy = std::fs::read_to_string(policy)?;
|
||||
let parser = PolicyParser::new(&policy_source, &unparsed_policy);
|
||||
parser.parse()
|
||||
}
|
||||
None => get_default_policy(),
|
||||
fn cmd_check(policy_paths: Vec<PathBuf>, args: Vec<String>, pretty: bool) -> Result<()> {
|
||||
let policy = load_policies(&policy_paths)?;
|
||||
|
||||
let eval = policy.check(&args);
|
||||
let json = if pretty {
|
||||
serde_json::to_string_pretty(&eval)?
|
||||
} else {
|
||||
serde_json::to_string(&eval)?
|
||||
};
|
||||
let policy = policy.map_err(StarlarkError::into_anyhow)?;
|
||||
|
||||
let exec = match args.command {
|
||||
Command::Check { command } => match command.split_first() {
|
||||
Some((first, rest)) => ExecArg {
|
||||
program: first.to_string(),
|
||||
args: rest.to_vec(),
|
||||
},
|
||||
None => {
|
||||
eprintln!("no command provided");
|
||||
std::process::exit(1);
|
||||
}
|
||||
},
|
||||
Command::CheckJson { exec } => exec,
|
||||
};
|
||||
|
||||
let (output, exit_code) = check_command(&policy, exec, args.require_safe);
|
||||
let json = serde_json::to_string(&output)?;
|
||||
println!("{json}");
|
||||
std::process::exit(exit_code);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn check_command(
|
||||
policy: &Policy,
|
||||
ExecArg { program, args }: ExecArg,
|
||||
check: bool,
|
||||
) -> (Output, i32) {
|
||||
let exec_call = ExecCall { program, args };
|
||||
match policy.check(&exec_call) {
|
||||
Ok(MatchedExec::Match { exec }) => {
|
||||
if exec.might_write_files() {
|
||||
let exit_code = if check {
|
||||
MATCHED_BUT_WRITES_FILES_EXIT_CODE
|
||||
} else {
|
||||
0
|
||||
};
|
||||
(Output::Match { r#match: exec }, exit_code)
|
||||
} else {
|
||||
(Output::Safe { r#match: exec }, 0)
|
||||
}
|
||||
}
|
||||
Ok(MatchedExec::Forbidden { reason, cause }) => {
|
||||
let exit_code = if check { FORBIDDEN_EXIT_CODE } else { 0 };
|
||||
(Output::Forbidden { reason, cause }, exit_code)
|
||||
}
|
||||
Err(err) => {
|
||||
let exit_code = if check { MIGHT_BE_SAFE_EXIT_CODE } else { 0 };
|
||||
(Output::Unverified { error: err }, exit_code)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Serialize)]
|
||||
#[serde(tag = "result")]
|
||||
pub enum Output {
|
||||
/// The command is verified as safe.
|
||||
#[serde(rename = "safe")]
|
||||
Safe { r#match: ValidExec },
|
||||
|
||||
/// The command has matched a rule in the policy, but the caller should
|
||||
/// decide whether it is "safe" given the files it wants to write.
|
||||
#[serde(rename = "match")]
|
||||
Match { r#match: ValidExec },
|
||||
|
||||
/// The user is forbidden from running the command.
|
||||
#[serde(rename = "forbidden")]
|
||||
Forbidden {
|
||||
reason: String,
|
||||
cause: codex_execpolicy::Forbidden,
|
||||
},
|
||||
|
||||
/// The safety of the command could not be verified.
|
||||
#[serde(rename = "unverified")]
|
||||
Unverified { error: codex_execpolicy::Error },
|
||||
}
|
||||
|
||||
fn deserialize_from_json<'de, D>(deserializer: D) -> Result<ExecArg, D::Error>
|
||||
where
|
||||
D: de::Deserializer<'de>,
|
||||
{
|
||||
let s = String::deserialize(deserializer)?;
|
||||
let decoded = serde_json::from_str(&s)
|
||||
.map_err(|e| serde::de::Error::custom(format!("JSON parse error: {e}")))?;
|
||||
Ok(decoded)
|
||||
}
|
||||
|
||||
impl FromStr for ExecArg {
|
||||
type Err = anyhow::Error;
|
||||
|
||||
fn from_str(s: &str) -> Result<Self, Self::Err> {
|
||||
serde_json::from_str(s).map_err(Into::into)
|
||||
fn load_policies(policy_paths: &[PathBuf]) -> Result<codex_execpolicy::Policy> {
|
||||
let mut parser = PolicyParser::new();
|
||||
for policy_path in policy_paths {
|
||||
let policy_file_contents = fs::read_to_string(policy_path)
|
||||
.with_context(|| format!("failed to read policy at {}", policy_path.display()))?;
|
||||
let policy_identifier = policy_path.to_string_lossy().to_string();
|
||||
parser.parse(&policy_identifier, &policy_file_contents)?;
|
||||
}
|
||||
Ok(parser.build())
|
||||
}
|
||||
|
||||
@@ -1,103 +1,84 @@
|
||||
use crate::decision::Decision;
|
||||
use crate::rule::RuleMatch;
|
||||
use crate::rule::RuleRef;
|
||||
use multimap::MultiMap;
|
||||
use regex_lite::Error as RegexError;
|
||||
use regex_lite::Regex;
|
||||
|
||||
use crate::ExecCall;
|
||||
use crate::Forbidden;
|
||||
use crate::MatchedExec;
|
||||
use crate::NegativeExamplePassedCheck;
|
||||
use crate::ProgramSpec;
|
||||
use crate::error::Error;
|
||||
use crate::error::Result;
|
||||
use crate::policy_parser::ForbiddenProgramRegex;
|
||||
use crate::program::PositiveExampleFailedCheck;
|
||||
use serde::Deserialize;
|
||||
use serde::Serialize;
|
||||
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct Policy {
|
||||
programs: MultiMap<String, ProgramSpec>,
|
||||
forbidden_program_regexes: Vec<ForbiddenProgramRegex>,
|
||||
forbidden_substrings_pattern: Option<Regex>,
|
||||
rules_by_program: MultiMap<String, RuleRef>,
|
||||
}
|
||||
|
||||
impl Policy {
|
||||
pub fn new(
|
||||
programs: MultiMap<String, ProgramSpec>,
|
||||
forbidden_program_regexes: Vec<ForbiddenProgramRegex>,
|
||||
forbidden_substrings: Vec<String>,
|
||||
) -> std::result::Result<Self, RegexError> {
|
||||
let forbidden_substrings_pattern = if forbidden_substrings.is_empty() {
|
||||
None
|
||||
} else {
|
||||
let escaped_substrings = forbidden_substrings
|
||||
.iter()
|
||||
.map(|s| regex_lite::escape(s))
|
||||
.collect::<Vec<_>>()
|
||||
.join("|");
|
||||
Some(Regex::new(&format!("({escaped_substrings})"))?)
|
||||
pub fn new(rules_by_program: MultiMap<String, RuleRef>) -> Self {
|
||||
Self { rules_by_program }
|
||||
}
|
||||
|
||||
pub fn empty() -> Self {
|
||||
Self::new(MultiMap::new())
|
||||
}
|
||||
|
||||
pub fn rules(&self) -> &MultiMap<String, RuleRef> {
|
||||
&self.rules_by_program
|
||||
}
|
||||
|
||||
pub fn check(&self, cmd: &[String]) -> Evaluation {
|
||||
let rules = match cmd.first() {
|
||||
Some(first) => match self.rules_by_program.get_vec(first) {
|
||||
Some(rules) => rules,
|
||||
None => return Evaluation::NoMatch,
|
||||
},
|
||||
None => return Evaluation::NoMatch,
|
||||
};
|
||||
Ok(Self {
|
||||
programs,
|
||||
forbidden_program_regexes,
|
||||
forbidden_substrings_pattern,
|
||||
})
|
||||
|
||||
let matched_rules: Vec<RuleMatch> =
|
||||
rules.iter().filter_map(|rule| rule.matches(cmd)).collect();
|
||||
match matched_rules.iter().map(RuleMatch::decision).max() {
|
||||
Some(decision) => Evaluation::Match {
|
||||
decision,
|
||||
matched_rules,
|
||||
},
|
||||
None => Evaluation::NoMatch,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn check(&self, exec_call: &ExecCall) -> Result<MatchedExec> {
|
||||
let ExecCall { program, args } = &exec_call;
|
||||
for ForbiddenProgramRegex { regex, reason } in &self.forbidden_program_regexes {
|
||||
if regex.is_match(program) {
|
||||
return Ok(MatchedExec::Forbidden {
|
||||
cause: Forbidden::Program {
|
||||
program: program.clone(),
|
||||
exec_call: exec_call.clone(),
|
||||
},
|
||||
reason: reason.clone(),
|
||||
});
|
||||
}
|
||||
}
|
||||
pub fn check_multiple<Commands>(&self, commands: Commands) -> Evaluation
|
||||
where
|
||||
Commands: IntoIterator,
|
||||
Commands::Item: AsRef<[String]>,
|
||||
{
|
||||
let matched_rules: Vec<RuleMatch> = commands
|
||||
.into_iter()
|
||||
.flat_map(|command| match self.check(command.as_ref()) {
|
||||
Evaluation::Match { matched_rules, .. } => matched_rules,
|
||||
Evaluation::NoMatch => Vec::new(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
for arg in args {
|
||||
if let Some(regex) = &self.forbidden_substrings_pattern
|
||||
&& regex.is_match(arg)
|
||||
{
|
||||
return Ok(MatchedExec::Forbidden {
|
||||
cause: Forbidden::Arg {
|
||||
arg: arg.clone(),
|
||||
exec_call: exec_call.clone(),
|
||||
},
|
||||
reason: format!("arg `{arg}` contains forbidden substring"),
|
||||
});
|
||||
}
|
||||
match matched_rules.iter().map(RuleMatch::decision).max() {
|
||||
Some(decision) => Evaluation::Match {
|
||||
decision,
|
||||
matched_rules,
|
||||
},
|
||||
None => Evaluation::NoMatch,
|
||||
}
|
||||
|
||||
let mut last_err = Err(Error::NoSpecForProgram {
|
||||
program: program.clone(),
|
||||
});
|
||||
if let Some(spec_list) = self.programs.get_vec(program) {
|
||||
for spec in spec_list {
|
||||
match spec.check(exec_call) {
|
||||
Ok(matched_exec) => return Ok(matched_exec),
|
||||
Err(err) => {
|
||||
last_err = Err(err);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
last_err
|
||||
}
|
||||
|
||||
pub fn check_each_good_list_individually(&self) -> Vec<PositiveExampleFailedCheck> {
|
||||
let mut violations = Vec::new();
|
||||
for (_program, spec) in self.programs.flat_iter() {
|
||||
violations.extend(spec.verify_should_match_list());
|
||||
}
|
||||
violations
|
||||
}
|
||||
|
||||
pub fn check_each_bad_list_individually(&self) -> Vec<NegativeExamplePassedCheck> {
|
||||
let mut violations = Vec::new();
|
||||
for (_program, spec) in self.programs.flat_iter() {
|
||||
violations.extend(spec.verify_should_not_match_list());
|
||||
}
|
||||
violations
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
pub enum Evaluation {
|
||||
NoMatch,
|
||||
Match {
|
||||
decision: Decision,
|
||||
#[serde(rename = "matchedRules")]
|
||||
matched_rules: Vec<RuleMatch>,
|
||||
},
|
||||
}
|
||||
|
||||
impl Evaluation {
|
||||
pub fn is_match(&self) -> bool {
|
||||
matches!(self, Self::Match { .. })
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
use std::any::Any;
|
||||
use std::sync::Arc;
|
||||
|
||||
use codex_execpolicy2::Decision;
|
||||
use codex_execpolicy2::Evaluation;
|
||||
use codex_execpolicy2::PolicyParser;
|
||||
use codex_execpolicy2::RuleMatch;
|
||||
use codex_execpolicy2::RuleRef;
|
||||
use codex_execpolicy2::rule::PatternToken;
|
||||
use codex_execpolicy2::rule::PrefixPattern;
|
||||
use codex_execpolicy2::rule::PrefixRule;
|
||||
use codex_execpolicy::Decision;
|
||||
use codex_execpolicy::Evaluation;
|
||||
use codex_execpolicy::PolicyParser;
|
||||
use codex_execpolicy::RuleMatch;
|
||||
use codex_execpolicy::RuleRef;
|
||||
use codex_execpolicy::rule::PatternToken;
|
||||
use codex_execpolicy::rule::PrefixPattern;
|
||||
use codex_execpolicy::rule::PrefixRule;
|
||||
use pretty_assertions::assert_eq;
|
||||
|
||||
fn tokens(cmd: &[&str]) -> Vec<String> {
|
||||
@@ -1,29 +0,0 @@
|
||||
[package]
|
||||
name = "codex-execpolicy2"
|
||||
version = { workspace = true }
|
||||
edition = "2024"
|
||||
description = "Codex exec policy v2: prefix-based Starlark rules for command decisions."
|
||||
|
||||
[lib]
|
||||
name = "codex_execpolicy2"
|
||||
path = "src/lib.rs"
|
||||
|
||||
[[bin]]
|
||||
name = "codex-execpolicy2"
|
||||
path = "src/main.rs"
|
||||
|
||||
[lints]
|
||||
workspace = true
|
||||
|
||||
[dependencies]
|
||||
anyhow = { workspace = true }
|
||||
clap = { workspace = true, features = ["derive"] }
|
||||
multimap = { workspace = true }
|
||||
serde = { workspace = true, features = ["derive"] }
|
||||
serde_json = { workspace = true }
|
||||
shlex = { workspace = true }
|
||||
starlark = { workspace = true }
|
||||
thiserror = { workspace = true }
|
||||
|
||||
[dev-dependencies]
|
||||
pretty_assertions = { workspace = true }
|
||||
@@ -1,59 +0,0 @@
|
||||
# codex-execpolicy2
|
||||
|
||||
## Overview
|
||||
- Policy engine and CLI built around `prefix_rule(pattern=[...], decision?, match?, not_match?)`.
|
||||
- This release covers only the prefix-rule subset of the planned execpolicy v2 language; a richer language will follow.
|
||||
- Tokens are matched in order; any `pattern` element may be a list to denote alternatives. `decision` defaults to `allow`; valid values: `allow`, `prompt`, `forbidden`.
|
||||
- `match` / `not_match` supply example invocations that are validated at load time (think of them as unit tests); examples can be token arrays or strings (strings are tokenized with `shlex`).
|
||||
- The CLI always prints the JSON serialization of the evaluation result.
|
||||
|
||||
## Policy shapes
|
||||
- Prefix rules use Starlark syntax:
|
||||
```starlark
|
||||
prefix_rule(
|
||||
pattern = ["cmd", ["alt1", "alt2"]], # ordered tokens; list entries denote alternatives
|
||||
decision = "prompt", # allow | prompt | forbidden; defaults to allow
|
||||
match = [["cmd", "alt1"], "cmd alt2"], # examples that must match this rule
|
||||
not_match = [["cmd", "oops"], "cmd alt3"], # examples that must not match this rule
|
||||
)
|
||||
```
|
||||
|
||||
## CLI
|
||||
- Provide one or more policy files (for example `src/default.codexpolicy`) to check a command:
|
||||
```bash
|
||||
cargo run -p codex-execpolicy2 -- check --policy path/to/policy.codexpolicy git status
|
||||
```
|
||||
- Pass multiple `--policy` flags to merge rules, evaluated in the order provided:
|
||||
```bash
|
||||
cargo run -p codex-execpolicy2 -- check --policy base.codexpolicy --policy overrides.codexpolicy git status
|
||||
```
|
||||
- Output is JSON by default; pass `--pretty` for pretty-printed JSON
|
||||
- Example outcomes:
|
||||
- Match: `{"match": { ... "decision": "allow" ... }}`
|
||||
- No match: `"noMatch"`
|
||||
|
||||
## Response shapes
|
||||
- Match:
|
||||
```json
|
||||
{
|
||||
"match": {
|
||||
"decision": "allow|prompt|forbidden",
|
||||
"matchedRules": [
|
||||
{
|
||||
"prefixRuleMatch": {
|
||||
"matchedPrefix": ["<token>", "..."],
|
||||
"decision": "allow|prompt|forbidden"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
- No match:
|
||||
```json
|
||||
"noMatch"
|
||||
```
|
||||
|
||||
- `matchedRules` lists every rule whose prefix matched the command; `matchedPrefix` is the exact prefix that matched.
|
||||
- The effective `decision` is the strictest severity across all matches (`forbidden` > `prompt` > `allow`).
|
||||
@@ -1,26 +0,0 @@
|
||||
use starlark::Error as StarlarkError;
|
||||
use thiserror::Error;
|
||||
|
||||
pub type Result<T> = std::result::Result<T, Error>;
|
||||
|
||||
#[derive(Debug, Error)]
|
||||
pub enum Error {
|
||||
#[error("invalid decision: {0}")]
|
||||
InvalidDecision(String),
|
||||
#[error("invalid pattern element: {0}")]
|
||||
InvalidPattern(String),
|
||||
#[error("invalid example: {0}")]
|
||||
InvalidExample(String),
|
||||
#[error(
|
||||
"expected every example to match at least one rule. rules: {rules:?}; unmatched examples: \
|
||||
{examples:?}"
|
||||
)]
|
||||
ExampleDidNotMatch {
|
||||
rules: Vec<String>,
|
||||
examples: Vec<String>,
|
||||
},
|
||||
#[error("expected example to not match rule `{rule}`: {example}")]
|
||||
ExampleDidMatch { rule: String, example: String },
|
||||
#[error("starlark error: {0}")]
|
||||
Starlark(StarlarkError),
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
pub mod decision;
|
||||
pub mod error;
|
||||
pub mod parser;
|
||||
pub mod policy;
|
||||
pub mod rule;
|
||||
|
||||
pub use decision::Decision;
|
||||
pub use error::Error;
|
||||
pub use error::Result;
|
||||
pub use parser::PolicyParser;
|
||||
pub use policy::Evaluation;
|
||||
pub use policy::Policy;
|
||||
pub use rule::Rule;
|
||||
pub use rule::RuleMatch;
|
||||
pub use rule::RuleRef;
|
||||
@@ -1,66 +0,0 @@
|
||||
use std::fs;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use anyhow::Context;
|
||||
use anyhow::Result;
|
||||
use clap::Parser;
|
||||
use codex_execpolicy2::PolicyParser;
|
||||
|
||||
/// CLI for evaluating exec policies
|
||||
#[derive(Parser)]
|
||||
#[command(name = "codex-execpolicy2")]
|
||||
enum Cli {
|
||||
/// Evaluate a command against a policy.
|
||||
Check {
|
||||
#[arg(short, long = "policy", value_name = "PATH", required = true)]
|
||||
policies: Vec<PathBuf>,
|
||||
|
||||
/// Pretty-print the JSON output.
|
||||
#[arg(long)]
|
||||
pretty: bool,
|
||||
|
||||
/// Command tokens to check.
|
||||
#[arg(
|
||||
value_name = "COMMAND",
|
||||
required = true,
|
||||
trailing_var_arg = true,
|
||||
allow_hyphen_values = true
|
||||
)]
|
||||
command: Vec<String>,
|
||||
},
|
||||
}
|
||||
|
||||
fn main() -> Result<()> {
|
||||
let cli = Cli::parse();
|
||||
match cli {
|
||||
Cli::Check {
|
||||
policies,
|
||||
command,
|
||||
pretty,
|
||||
} => cmd_check(policies, command, pretty),
|
||||
}
|
||||
}
|
||||
|
||||
fn cmd_check(policy_paths: Vec<PathBuf>, args: Vec<String>, pretty: bool) -> Result<()> {
|
||||
let policy = load_policies(&policy_paths)?;
|
||||
|
||||
let eval = policy.check(&args);
|
||||
let json = if pretty {
|
||||
serde_json::to_string_pretty(&eval)?
|
||||
} else {
|
||||
serde_json::to_string(&eval)?
|
||||
};
|
||||
println!("{json}");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn load_policies(policy_paths: &[PathBuf]) -> Result<codex_execpolicy2::Policy> {
|
||||
let mut parser = PolicyParser::new();
|
||||
for policy_path in policy_paths {
|
||||
let policy_file_contents = fs::read_to_string(policy_path)
|
||||
.with_context(|| format!("failed to read policy at {}", policy_path.display()))?;
|
||||
let policy_identifier = policy_path.to_string_lossy().to_string();
|
||||
parser.parse(&policy_identifier, &policy_file_contents)?;
|
||||
}
|
||||
Ok(parser.build())
|
||||
}
|
||||
@@ -1,84 +0,0 @@
|
||||
use crate::decision::Decision;
|
||||
use crate::rule::RuleMatch;
|
||||
use crate::rule::RuleRef;
|
||||
use multimap::MultiMap;
|
||||
use serde::Deserialize;
|
||||
use serde::Serialize;
|
||||
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct Policy {
|
||||
rules_by_program: MultiMap<String, RuleRef>,
|
||||
}
|
||||
|
||||
impl Policy {
|
||||
pub fn new(rules_by_program: MultiMap<String, RuleRef>) -> Self {
|
||||
Self { rules_by_program }
|
||||
}
|
||||
|
||||
pub fn empty() -> Self {
|
||||
Self::new(MultiMap::new())
|
||||
}
|
||||
|
||||
pub fn rules(&self) -> &MultiMap<String, RuleRef> {
|
||||
&self.rules_by_program
|
||||
}
|
||||
|
||||
pub fn check(&self, cmd: &[String]) -> Evaluation {
|
||||
let rules = match cmd.first() {
|
||||
Some(first) => match self.rules_by_program.get_vec(first) {
|
||||
Some(rules) => rules,
|
||||
None => return Evaluation::NoMatch,
|
||||
},
|
||||
None => return Evaluation::NoMatch,
|
||||
};
|
||||
|
||||
let matched_rules: Vec<RuleMatch> =
|
||||
rules.iter().filter_map(|rule| rule.matches(cmd)).collect();
|
||||
match matched_rules.iter().map(RuleMatch::decision).max() {
|
||||
Some(decision) => Evaluation::Match {
|
||||
decision,
|
||||
matched_rules,
|
||||
},
|
||||
None => Evaluation::NoMatch,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn check_multiple<Commands>(&self, commands: Commands) -> Evaluation
|
||||
where
|
||||
Commands: IntoIterator,
|
||||
Commands::Item: AsRef<[String]>,
|
||||
{
|
||||
let matched_rules: Vec<RuleMatch> = commands
|
||||
.into_iter()
|
||||
.flat_map(|command| match self.check(command.as_ref()) {
|
||||
Evaluation::Match { matched_rules, .. } => matched_rules,
|
||||
Evaluation::NoMatch => Vec::new(),
|
||||
})
|
||||
.collect();
|
||||
|
||||
match matched_rules.iter().map(RuleMatch::decision).max() {
|
||||
Some(decision) => Evaluation::Match {
|
||||
decision,
|
||||
matched_rules,
|
||||
},
|
||||
None => Evaluation::NoMatch,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
pub enum Evaluation {
|
||||
NoMatch,
|
||||
Match {
|
||||
decision: Decision,
|
||||
#[serde(rename = "matchedRules")]
|
||||
matched_rules: Vec<RuleMatch>,
|
||||
},
|
||||
}
|
||||
|
||||
impl Evaluation {
|
||||
pub fn is_match(&self) -> bool {
|
||||
matches!(self, Self::Match { .. })
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user