adjust seatbelt to allow write into specific dirs under user home (#289)
This commit is contained in:
parent
448a24746c
commit
b59a940057
|
@ -3,13 +3,14 @@
|
|||
;; allow everything by default
|
||||
(allow default)
|
||||
|
||||
;; deny all writes EXCEPT under project directory, temp directory, stdout/stderr and /dev/null
|
||||
;; deny all writes EXCEPT under specific paths
|
||||
(deny file-write*)
|
||||
(allow file-write*
|
||||
(subpath (param "TARGET_DIR"))
|
||||
(subpath (param "TMP_DIR"))
|
||||
(subpath (string-append (param "HOME_DIR") "/.gemini"))
|
||||
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
||||
(literal "/dev/stdout")
|
||||
(literal "/dev/stderr")
|
||||
(literal "/dev/null")
|
||||
)
|
||||
|
||||
)
|
|
@ -66,6 +66,8 @@
|
|||
(allow file-write*
|
||||
(subpath (param "TARGET_DIR"))
|
||||
(subpath (param "TMP_DIR"))
|
||||
(subpath (string-append (param "HOME_DIR") "/.gemini"))
|
||||
(subpath (string-append (param "HOME_DIR") "/.npm"))
|
||||
(literal "/dev/stdout")
|
||||
(literal "/dev/stderr")
|
||||
(literal "/dev/null")
|
||||
|
|
|
@ -145,9 +145,11 @@ export async function start_sandbox(sandbox: string) {
|
|||
process.env.SEATBELT_PROFILE ??= 'minimal';
|
||||
const args = [
|
||||
'-D',
|
||||
`TARGET_DIR=${process.cwd()}`,
|
||||
`TARGET_DIR=${fs.realpathSync(process.cwd())}`,
|
||||
'-D',
|
||||
`TMP_DIR=${fs.realpathSync(os.tmpdir())}`,
|
||||
'-D',
|
||||
`HOME_DIR=${fs.realpathSync(os.homedir())}`,
|
||||
'-f',
|
||||
new URL(
|
||||
`sandbox-macos-${process.env.SEATBELT_PROFILE}.sb`,
|
||||
|
|
Loading…
Reference in New Issue