default.yaml

# Agent Sandbox Policy for agentsh
# Maximum containment for running unknown/untrusted agent code

version: 1
name: default
description: |
  High-security sandbox for AI agents running unknown code.
  Default deny with explicit allowlist, approval for any credential access,
  redirect network tools to internal proxies, soft-delete for recovery.

# =============================================================================
# FILE OPERATION RULES
# =============================================================================

file_rules:
  # ---------------------------------------------------------------------------
  # Workspace - read/write allowed, deletes are soft (recoverable)
  # ---------------------------------------------------------------------------

  - name: allow-workspace-read
    description: Allow reading files in workspace
    paths:
      - "${PROJECT_ROOT}"
      - "${PROJECT_ROOT}/**"
      - "/workspace"
      - "/workspace/**"
    operations:
      - read
      - open
      - stat
      - list
      - readlink
    decision: allow

  - name: allow-workspace-write
    description: Allow writing files in workspace
    paths:
      - "${PROJECT_ROOT}"
      - "${PROJECT_ROOT}/**"
      - "/workspace"
      - "/workspace/**"
    operations:
      - write
      - create
      - mkdir
      - chmod
      - rename
    decision: allow

  - name: soft-delete-workspace
    description: Soft-delete files in workspace (recoverable)
    paths:
      - "${PROJECT_ROOT}"
      - "${PROJECT_ROOT}/**"
      - "/workspace"
      - "/workspace/**"
    operations:
      - delete
      - rmdir
    decision: soft_delete
    message: "File quarantined (recoverable): {{.Path}}"

  # ---------------------------------------------------------------------------
  # Temp directories - sandboxed
  # ---------------------------------------------------------------------------

  - name: allow-tmp
    description: Full access to temp directories
    paths:
      - "/tmp/**"
      - "/var/tmp/**"
    operations:
      - "*"
    decision: allow

  # ---------------------------------------------------------------------------
  # Block dangerous binaries (before system read allow)
  # ---------------------------------------------------------------------------

  - name: block-dangerous-binaries
    description: Block execution of privilege escalation tools
    paths:
      - "/usr/bin/sudo"
      - "/usr/bin/su"
      - "/usr/bin/pkexec"
      - "/usr/bin/doas"
      - "/bin/su"
      - "/usr/sbin/chroot"
      - "/usr/bin/nsenter"
      - "/usr/bin/unshare"
    operations:
      - "*"
    decision: deny
    message: "Access to privilege escalation tool blocked: {{.Path}}"

  - name: block-e2b-internals
    description: Block access to E2B infrastructure binaries and configs
    paths:
      - "/usr/bin/envd"           # E2B environment daemon
      - "/usr/bin/socat"          # Used for E2B port forwarding
      - "/etc/systemd/**"         # Systemd configs
      - "/run/systemd/**"         # Systemd runtime
    operations:
      - "*"
    decision: deny
    message: "Access to E2B/system infrastructure blocked: {{.Path}}"

  # ---------------------------------------------------------------------------
  # System paths - minimal read-only
  # ---------------------------------------------------------------------------

  - name: allow-system-read
    description: Read access to system paths
    paths:
      - "/usr/**"
      - "/lib/**"
      - "/lib64/**"
      - "/bin/**"
      - "/sbin/**"
    operations:
      - read
      - open
      - stat
      - list
      - readlink
    decision: allow

  - name: allow-etc-minimal
    description: Read minimal config files
    paths:
      - "/etc/hosts"
      - "/etc/resolv.conf"
      - "/etc/ssl/certs/**"
      - "/etc/ca-certificates/**"
      - "/etc/localtime"
      - "/etc/ld.so.cache"
      - "/etc/ld.so.preload"
      - "/etc/ld.so.nohwcap"
      - "/etc/nsswitch.conf"
      - "/etc/passwd"
      - "/etc/group"
      - "/etc/fuse.conf"
    operations:
      - read
      - stat
    decision: allow

  # ---------------------------------------------------------------------------
  # APPROVE credential/secret access (not deny - visible decision)
  # ---------------------------------------------------------------------------

  - name: approve-ssh-access
    description: Require approval for SSH key access
    paths:
      - "${HOME}/.ssh/**"
      - "/root/.ssh/**"
    operations:
      - "*"
    decision: approve
    message: "Agent wants to access SSH keys: {{.Path}}"
    timeout: 5m

  - name: approve-aws-credentials
    description: Require approval for AWS credentials
    paths:
      - "${HOME}/.aws/**"
      - "/root/.aws/**"
    operations:
      - "*"
    decision: approve
    message: "Agent wants to access AWS credentials: {{.Path}}"
    timeout: 5m

  - name: approve-cloud-credentials
    description: Require approval for cloud credentials
    paths:
      - "${HOME}/.gcloud/**"
      - "${HOME}/.azure/**"
      - "${HOME}/.config/gcloud/**"
      - "${HOME}/.kube/**"
    operations:
      - "*"
    decision: approve
    message: "Agent wants to access cloud credentials: {{.Path}}"
    timeout: 5m

  - name: approve-env-files
    description: Require approval for .env files
    paths:
      - "**/.env"
      - "**/.env.*"
    operations:
      - "*"
    decision: approve
    message: "Agent wants to access environment file: {{.Path}}"
    timeout: 5m

  - name: approve-git-credentials
    description: Require approval for git credentials
    paths:
      - "${HOME}/.git-credentials"
      - "**/.netrc"
    operations:
      - "*"
    decision: approve
    message: "Agent wants to access git credentials: {{.Path}}"
    timeout: 5m

  # ---------------------------------------------------------------------------
  # Package caches - read-only
  # ---------------------------------------------------------------------------

  - name: allow-cache-read
    description: Read-only cache access
    paths:
      - "${HOME}/.npm/**"
      - "${HOME}/.cache/**"
      - "${HOME}/.cargo/**"
      - "/root/.npm/**"
      - "/root/.cache/**"
      - "/root/.cargo/**"
    operations:
      - read
      - open
      - stat
      - list
    decision: allow

  # ---------------------------------------------------------------------------
  # Allow essential runtime paths (before deny rules)
  # ---------------------------------------------------------------------------

  - name: allow-dev-essentials
    description: Allow access to essential device files
    paths:
      - "/dev/null"
      - "/dev/zero"
      - "/dev/urandom"
      - "/dev/random"
      - "/dev/stdin"
      - "/dev/stdout"
      - "/dev/stderr"
      - "/dev/fd/**"
      - "/dev/pts/**"
      - "/dev/tty"
    operations:
      - read
      - open
      - write
      - stat
    decision: allow

  - name: allow-proc-self
    description: Allow process self-inspection
    paths:
      - "/proc/self/**"
      - "/proc/thread-self/**"
    operations:
      - read
      - open
      - stat
      - readlink
    decision: allow

  # ---------------------------------------------------------------------------
  # DENY everything else
  # ---------------------------------------------------------------------------

  - name: deny-proc-sys
    description: Block /proc and /sys
    paths:
      - "/proc/**"
      - "/sys/**"
    operations:
      - "*"
    decision: deny

  - name: default-deny-files
    description: Deny all other file operations
    paths:
      - "**"
    operations:
      - "*"
    decision: deny

# =============================================================================
# NETWORK OPERATION RULES
# =============================================================================

network_rules:
  # ---------------------------------------------------------------------------
  # Localhost only by default
  # ---------------------------------------------------------------------------

  - name: allow-localhost
    description: Allow localhost connections
    cidrs:
      - "127.0.0.1/32"
      - "::1/128"
    decision: allow

  # ---------------------------------------------------------------------------
  # Package registries - redirect to internal mirrors if available
  # ---------------------------------------------------------------------------

  - name: allow-npm
    description: npm registry
    domains:
      - "registry.npmjs.org"
    ports: [443]
    decision: allow

  - name: allow-pypi
    description: PyPI
    domains:
      - "pypi.org"
      - "files.pythonhosted.org"
    ports: [443]
    decision: allow

  - name: allow-cargo
    description: Cargo registry
    domains:
      - "crates.io"
      - "static.crates.io"
    ports: [443]
    decision: allow

  - name: allow-go-proxy
    description: Go module proxy
    domains:
      - "proxy.golang.org"
      - "sum.golang.org"
    ports: [443]
    decision: allow

  # ---------------------------------------------------------------------------
  # Embedded LLM Proxy
  # ---------------------------------------------------------------------------

  - name: allow-llm-proxy
    description: Allow connections to embedded LLM proxy on localhost
    cidrs:
      - "127.0.0.1/32"
    decision: allow

  # ---------------------------------------------------------------------------
  # Block private/internal networks
  # ---------------------------------------------------------------------------

  - name: block-private-networks
    description: Block internal/private networks
    cidrs:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
      - "169.254.0.0/16"
    decision: deny

  - name: block-metadata-services
    description: Block cloud metadata services
    cidrs:
      - "169.254.169.254/32"
      - "100.100.100.200/32"
    decision: deny

  - name: block-e2b-internal
    description: Block E2B internal services (events, orchestration)
    cidrs:
      - "192.0.2.0/24"      # E2B events service (TEST-NET-1 range)
    decision: deny
    message: "Access to E2B internal services blocked"

  # ---------------------------------------------------------------------------
  # Block malicious/untrusted domains
  # ---------------------------------------------------------------------------

  - name: block-evil-domains
    description: Block known malicious domains
    domains:
      - "evil.com"
      - "*.evil.com"
    decision: deny
    message: "Connection to untrusted domain blocked: {{.RemoteAddr}}"

  # ---------------------------------------------------------------------------
  # Default deny for all other destinations
  # Only explicitly allowed domains/IPs can be accessed
  # ---------------------------------------------------------------------------

  - name: default-deny-network
    description: Deny all other network connections (default deny)
    domains:
      - "*"
    decision: deny
    message: "Network access blocked - not in allowlist: {{.RemoteAddr}}"

# =============================================================================
# COMMAND RULES
# =============================================================================

command_rules:
  # ---------------------------------------------------------------------------
  # Allow curl/wget - network rules will block malicious domains
  # ---------------------------------------------------------------------------

  - name: allow-network-tools
    description: Allow curl/wget (network rules enforce domain policy)
    commands:
      - curl
      - wget
    decision: allow

  # ---------------------------------------------------------------------------
  # Allow safe commands
  # ---------------------------------------------------------------------------

  - name: allow-safe-commands
    description: Standard safe commands
    commands:
      - bash
      - sh
      - /bin/bash
      - /bin/sh
      - /usr/bin/bash
      - /usr/bin/sh
      - ls
      - cat
      - head
      - tail
      - grep
      - find
      - wc
      - sort
      - uniq
      - diff
      - pwd
      - echo
      - date
      - which
    decision: allow

  - name: allow-dev-tools
    description: Development tools
    commands:
      - git
      - node
      - npm
      - python
      - python3
      - pip
      - pip3
      - cargo
      - go
      - make
    decision: allow

  # ---------------------------------------------------------------------------
  # Approve package installation
  # ---------------------------------------------------------------------------

  - name: approve-package-install
    description: Require approval for package installation
    commands:
      - npm
      - pip
      - pip3
      - cargo
    args_patterns:
      - "^install.*"
      - "^add.*"
    decision: approve
    message: "Agent wants to install packages: {{.Args}}"

  # ---------------------------------------------------------------------------
  # Block dangerous commands
  # ---------------------------------------------------------------------------

  - name: block-rm-recursive
    description: Block recursive delete
    commands:
      - rm
    args_patterns:
      - ".*-r.*"
      - ".*--recursive.*"
    decision: deny
    message: "Recursive delete blocked. Files can be removed individually."

  - name: block-network-tools
    description: Block raw network tools
    commands:
      - nc
      - netcat
      - ncat
      - socat
      - telnet
      - ssh
      - scp
      - rsync
    decision: deny

  - name: block-system-commands
    description: Block system administration commands
    commands:
      - shutdown
      - reboot
      - systemctl
      - service
      - mount
      - umount
      - dd
      - fdisk
      - mkfs
      - kill
      - killall
      - pkill
    decision: deny

  - name: block-shell-escape
    description: Block potential shell escapes
    commands:
      - sudo
      - su
      - chroot
      - nsenter
      - unshare
    decision: deny

  - name: block-e2b-interference
    description: Block commands that could interfere with E2B infrastructure
    commands:
      - socat           # Used by E2B for port forwarding
      - envd            # E2B environment daemon
      - iptables        # Network rules manipulation
      - ip6tables
      - nft             # nftables
      - tc              # Traffic control
      - ip              # Network config (ip addr, ip route, etc.)
    decision: deny
    message: "Command blocked - could interfere with sandbox infrastructure"

  # ---------------------------------------------------------------------------
  # Allow all other commands (E2B needs general shell access)
  # Security is enforced via file_rules and network_rules
  # ---------------------------------------------------------------------------

  - name: allow-other-commands
    description: Allow remaining commands for E2B compatibility
    commands:
      - "*"
    decision: allow

# =============================================================================
# ENVIRONMENT POLICY
# =============================================================================

env_policy:
  # Allowlist of environment variables that commands can access
  # Wildcards supported: PATH, HOME, USER, LANG*, LC_*, TERM*, etc.
  allow:
    - PATH
    - HOME
    - USER
    - SHELL
    - LANG
    - LANG_*
    - LC_*
    - TERM
    - TERM_*
    - TZ
    - PWD
    - OLDPWD
    - SHLVL
    - _
    # Node.js
    - NODE_ENV
    - NODE_PATH
    - NPM_*
    # Python
    - PYTHONPATH
    - VIRTUAL_ENV
    - PIP_*
    # Git
    - GIT_*
    # Agentsh
    - AGENTSH_*
    # HTTP proxy settings (for network rules)
    - HTTP_PROXY
    - HTTPS_PROXY
    - http_proxy
    - https_proxy
    - NO_PROXY
    - no_proxy

  # Denylist - these are always blocked even if they match allow patterns
  deny:
    - AWS_*
    - AZURE_*
    - GCP_*
    - GOOGLE_*
    - OPENAI_API_KEY
    - ANTHROPIC_API_KEY
    - DATABASE_URL
    - DB_*
    - SECRET_*
    - PASSWORD*
    - PRIVATE_*
    - API_KEY*
    - TOKEN*

  # Limits to prevent env enumeration attacks
  max_bytes: 65536      # Max total size of env vars (64KB)
  max_keys: 100         # Max number of env vars
  block_iteration: true # Prevent enumeration of all env vars (individual getenv still works)

# =============================================================================
# RESOURCE LIMITS - Conservative
# =============================================================================

resource_limits:
  max_memory_mb: 2048
  memory_swap_max_mb: 0
  cpu_quota_percent: 50
  pids_max: 100
  disk_read_bps_max: 52428800   # 50 MB/s
  disk_write_bps_max: 26214400  # 25 MB/s
  command_timeout: 5m
  session_timeout: 1h
  idle_timeout: 15m

# =============================================================================
# AUDIT SETTINGS - FULL LOGGING
# =============================================================================

audit:
  log_allowed: true
  log_denied: true
  log_approved: true
  include_stdout: true
  include_stderr: true
  include_file_content: false
  retention_days: 90