procage

Presets

procage's frozen presets (minimal, agent_readonly, agent_workspace, build): what each grants, the base profile and environment they use, and how they behave on Linux tiers.

A preset is a function that returns an ordinary Policy, to inspect and extend like any other. Presets are frozen: a version never loosens. Use version 3.

use procage::policy::{presets, AbsPath, Network};

let workspace = AbsPath::new("/path/to/project")?;
let mut policy = presets::agent_workspace::v3(&workspace);
policy.net = Network::All; // your own addition; the preset tag stays for receipts

The presets#

PresetAdds
minimal::v1, v2, v3nothing
agent_readonly::v1, v2, v3read of the workspace, the tmpdir grant, fork, signals to self and children
agent_workspace::v1, v2, v3as agent_readonly, plus write and exec on the workspace
build::v1as agent_workspace, plus loopback network (any port)
build::v2, build::v3as build::v1, plus Unix sockets in the workspace

Every preset also has:

  • the base profile of the same version;
  • the full hard-deny tier, nothing waived;
  • an environment allowlist of HOME, LANG, LC_ALL, PATH, TERM, TMPDIR and USER;
  • a PresetTag with its name and version;
  • the default Lifetime::Run: the processes a forking preset’s child starts end with the run.

On Linux#

  • build is a capability gap on both tiers: Linux cages have no loopback networking. Cage::fit with Relax::no_loopback() runs it with no network at all.
  • The write rules of agent_workspace and build reach trust-handoff names such as .git/hooks and .bashrc. Tier T1 makes the existing ones read-only at spawn, an approximation accepted with LowerOptions::accept_spawn_snapshot(); tier T2 refuses the policy unless the class is waived.
  • signals: SelfAndChildren needs Landlock ABI 6 (Linux 6.12). On older kernels it is a gap; Relax::signals_same_user() is the named way out.

Edit this page on GitHub