feat(config): safe-by-default policy engine (config phase C2) - #101
Merged
Conversation
Second slice of the config policy gate (#58, phase C), per docs/design-config.md. xff/config/policy.{h,cc}: - LineSafety(line): the most restrictive registry safety class among a line's flags (kNone < kSafety < kSecurity); an attached binding like -capture=tag is classified by its base name. - LinePermitted(line, layer, policy): the safe-by-default decision. The built-in table denies the project layer any kSecurity (exec family) or kSafety (-delete) line; user and system may do anything. The system [policy] rules then override per layer, deny beats allow, addressing flags by name or by @safe/@sensitive/@destructive class token. Pure decision logic, no wiring yet; C3 gates the resolved lines in the config path with drop-and-warn + --explain drops + a hostile-.xffrc binary test. Unit tests cover worst-flag classification, built-in project deny, allow-loosen (by name + class), deny-tighten, deny-beats-allow, and per-layer scoping. Green on default + clang-asan.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second slice of the config policy gate (#58, phase C), per
docs/design-config.md.xff/config/policy.{h,cc}:LineSafety(line): the most restrictive registry safety class among the flags of a line (kNone < kSafety < kSecurity); an attached binding like-capture=tagis classified by its base name.LinePermitted(line, layer, policy): the safe-by-default decision. The built-in table denies the project layer anykSecurity(exec family) orkSafety(-delete) line; user and system may do anything. The system[policy]rules then override per layer, deny beats allow, addressing flags by name or by@safe/@sensitive/@destructiveclass token.Pure decision logic, no wiring yet. C3 gates the resolved lines with drop-and-warn +
--explaindrops + a hostile-.xffrcbinary test.Unit tests: worst-flag classification, built-in project deny, allow-loosen (by name + class), deny-tighten, deny-beats-allow, per-layer scoping. Green on default +
--config=clang --config=asan.