1 line
6.5 KiB
JSON
1 line
6.5 KiB
JSON
{"repo": "canyonroad/agentsh-exe.dev", "files": {"config.yaml": {"d44328ea1ab41e77aeb67634d03c435146320251": {"t": 1785674468.9567544, "n": 6121, "h": "656a0b0a91a821ba", "c": "# agentsh server configuration for exe.dev VM\n# Extends default config with settings optimized for exe.dev environment\n\nserver:\n http:\n addr: \"127.0.0.1:18080\"\n read_timeout: \"30s\"\n write_timeout: \"60s\"\n max_request_size: \"10MB\"\n grpc:\n enabled: true\n addr: \"127.0.0.1:9090\"\n\nauth:\n type: \"none\"\n\nlogging:\n level: \"info\"\n format: \"text\"\n output: \"stderr\"\n\nsessions:\n base_dir: \"/var/lib/agentsh/sessions\"\n max_sessions: 100\n default_timeout: \"1h\"\n default_idle_timeout: \"15m\"\n cleanup_interval: \"5m\"\n\naudit:\n enabled: true\n storage:\n sqlite_path: \"/var/lib/agentsh/events.db\"\n\nsandbox:\n enabled: true\n allow_degraded: false # exe.dev has full capability — don't degrade\n\n limits:\n max_memory_mb: 4096\n max_cpu_percent: 100\n max_processes: 256\n\n # FUSE filesystem for file operation interception\n # Detected as available in exe.dev\n fuse:\n enabled: true\n deferred: true\n deferred_marker_file: \"/tmp/.agentsh-fuse-enabled\"\n deferred_enable_command: [\"/bin/chmod\", \"666\", \"/dev/fuse\"]\n audit:\n mode: \"soft_delete\"\n\n network:\n enabled: true\n intercept_mode: \"all\"\n proxy_listen_addr: \"127.0.0.1:0\"\n\n # Cgroups v2 detected as available in exe.dev\n cgroups:\n enabled: true\n\n # Seccomp settings\n # seccomp wrapper enabled for file_monitor; ptrace handles execve separately.\n seccomp:\n enabled: true\n execve:\n enabled: false # ptrace handles execve; MUST remain false (validated)\n # File I/O interception via seccomp — enforces file_rules at syscall level\n file_monitor:\n enabled: true\n enforce_without_fuse: true\n # Dirty Frag (v0.19.3) kernel-exploit mitigation: scopes AF_RXRPC and\n # AF_NETLINK(NETLINK_XFRM) sockets that agents never need. Conservative set —\n # does not block all AF_NETLINK.\n mitigation_sets:\n - dirtyfrag-conservative\n\n # Ptrace - execve-only interception (hybrid mode with seccomp wrapper)\n # Catches child process execve() calls (env sudo, xargs sudo, python subprocess, etc.)\n # that bypass the API-level command precheck.\n ptrace:\n enabled: true\n trace:\n execve: true\n file: false # seccomp wrapper handles file monitoring\n network: false # seccomp wrapper handles network monitoring\n signal: false # seccomp wrapper handles signal filtering\n performance:\n seccomp_prefilter: true\n\n # Unix socket wrapper - seccomp-based unix socket interception\n unix_sockets:\n enabled: true\n\n# Landlock - kernel-level filesystem restriction (v5 on exe.dev)\n# Derives write-allowed paths from policy (workspace + /tmp only),\n# blocking writes to /etc, /usr/bin, etc. even for root.\nlandlock:\n enabled: true\n allow_execute:\n - /usr/bin\n - /usr/sbin\n - /usr/local/bin\n - /bin\n - /sbin\n - /usr/lib\n - /lib\n - /lib64\n allow_read:\n - /usr\n - /lib\n - /lib64\n - /bin\n - /sbin\n - /etc\n - /proc\n - /sys\n - /dev\n - /tmp\n - /var\n - /root\n allow_write:\n - /root\n - /workspace\n - /tmp\n - /var/tmp\n - /var/lib/agentsh\n # Defense-in-depth: explicitly deny container-escape sockets even if present.\n # Recommended by `agentsh detect config`.\n deny_paths:\n - /var/run/docker.sock\n - /run/containerd/containerd.sock\n\n# Security mode — landlock is the honest achievable mode on exe.dev.\n# `agentsh detect` (v0.20.2 real-install probe) scores this environment 85/100:\n# file/command/network/resource enforcement all active, but ISOLATION (pid-namespace,\n# capability-drop) is unavailable because the VM runs in the host namespace with full\n# caps — those require startup-time mechanisms agentsh can't apply to itself. Declaring\n# `mode: full` would silently degrade to landlock; we declare the real mode instead.\n# ptrace, seccomp (file_monitor), and FUSE remain independently enabled under sandbox: below.\nsecurity:\n mode: landlock\n strict: true # fail-fast if landlock enforcement can't be applied (fail-closed)\n warn_degraded: true # log a warning if the server runs below the requested mode\n\n# Capabilities as recommended by agentsh detect\ncapabilities:\n allow: []\n\nproxy:\n mode: \"embedded\"\n port: 0\n providers:\n anthropic: \"https://api.anthropic.com\"\n openai: \"https://api.openai.com\"\n\ndlp:\n mode: \"redact\"\n patterns:\n email: true\n phone: true\n credit_card: true\n ssn: true\n api_keys: true\n custom_patterns:\n - name: openai_key\n display: OPENAI_KEY\n regex: \"sk-[a-zA-Z0-9]{48,}\"\n - name: anthropic_key\n display: ANTHROPIC_KEY\n regex: \"sk-ant-[a-zA-Z0-9-]{95,}\"\n - name: aws_access_key\n display: AWS_KEY\n regex: \"AKIA[0-9A-Z]{16}\"\n - name: github_pat\n display: GITHUB_TOKEN\n regex: \"ghp_[a-zA-Z0-9]{36}\"\n - name: github_oauth\n display: GITHUB_OAUTH\n regex: \"gho_[a-zA-Z0-9]{36}\"\n - name: jwt_token\n display: JWT\n regex: \"eyJ[a-zA-Z0-9_-]*\\\\.eyJ[a-zA-Z0-9_-]*\\\\.[a-zA-Z0-9_-]*\"\n - name: private_key\n display: PRIVATE_KEY\n regex: \"-----BEGIN [A-Z]+ PRIVATE KEY-----\"\n - name: slack_token\n display: SLACK_TOKEN\n regex: \"xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}\"\n\npolicies:\n dir: \"/etc/agentsh/policies\"\n default_policy: \"default\"\n # Keep the v0.20.1 default `evaluate` (NOT `deny`). The FUSE workspace is mounted\n # on /root, so resolving a command's working_dir crosses that mount via a symlink;\n # `deny` rejects it with \"working_dir symlink escapes workspace mount\", breaking\n # nearly every shim-routed command (same class of breakage as `python -m venv`).\n # `evaluate` resolves the target and applies file_rules, which is the safe choice here.\n symlink_escape: evaluate\n # env_shim_path intentionally omitted — the statically-linked shell shim\n # cannot be used as an LD_PRELOAD library. Env iteration blocking handled\n # by policy env_policy.block_iteration instead.\n\napprovals:\n enabled: false\n mode: \"async\"\n timeout: \"5m\"\n\nmetrics:\n enabled: true\n path: \"/metrics\"\n\nhealth:\n path: \"/health\"\n readiness_path: \"/ready\"\n\ndevelopment:\n disable_auth: true\n verbose_errors: true\n"}}}} |