docs(secure-agent-internals): note macOS chained-curl gap in The blind spot - #25
Merged
Conversation
…d spot Verification surfaced a real gap that the doc currently understates: - `permissions.deny` patterns match against the *first* command of a Bash tool invocation, not against every command in a multi-command chain. A standalone `curl https://example.com` is correctly denied at the permission prompt; the same call buried mid-pipeline (`echo a; curl https://example.com; echo b`) starts as `echo a` and slips past the deny list. - On Linux, that gap is closed by socat's SNI proxy: even when the runtime lets `curl` start, the network layer of the sandbox blocks the egress unless the destination host is on `sandbox.network.allowedDomains`. - On macOS there is no socat. The framework's setup uses Seatbelt for filesystem isolation but does not currently wrap Bash- subprocess network egress on macOS, so a chained `curl` reaches the network on macOS even when the same call would be blocked on Linux. Adds a sub-section to `## The blind spot: Bash(curl *) and DNS-over-HTTPS` documenting the matching behaviour and the macOS- specific gap. Lists three mitigations in increasing strength (issue Bash calls one command at a time; run an OS-level packet filter; future framework enhancement to wrap macOS subprocesses in a network-restricting sandbox-exec profile). Generated-by: Claude Code (Opus 4.7)
andreahlert
added
the
mode:platform
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification surfaced a real gap that the existing
## The blind spot: Bash(curl *) and DNS-over-HTTPSsection understates:permissions.denypatterns match the first command of a Bash invocation only — chained calls (echo a; curl ...; echo b) slip past because the runtime seesecho aand lets the chain run.curlreaches the network on macOS.Adds a sub-section under "The blind spot" documenting the matching behaviour and the macOS-specific gap, plus three mitigations:
verify-secure-configskill already does this for its denial checks).pfon macOS,nftableson Linux) whitelisting the same hosts assandbox.network.allowedDomains.sandbox-execprofile that restrictsnetwork*operations the way the current profile restrictsfile-read*. Open follow-up, not shipped today.Test plan
prek run --files secure-agent-internals.mdclean (markdownlint, typos, doctoc TOC regen).### macOS: permissions.deny first-command-only matchingH3 sub-section renders correctly under## The blind spot.#macos-permissionsdeny-first-command-only-matching) appears in the regenerated TOC.