3 ms·
On MacOS you have a seatbelt sandbox built-in. On Linux - docker with SELinux or similar utility over namespaces. You need to model attack vector first. `rm -
by aka-rider 3mo ago
On MacOS you have a seatbelt sandbox built-in.
On Linux - docker with SELinux or similar utility over namespaces.
You need to model attack vector first.
`rm -rf` - restricted write
`curl malware.sh | sh` restrict execution from writeable dirs (seatbelt/SELinux)
Restricted write to sensitive directories would most likely neuter most malware.
Credentials leak - cleanup environment, deny reading .ssh, .aws, other, and don't allow LLMs anywhere near production systems.
I made a small utility for MacOS https://github.com/aka-rider/leash https://github.com/aka-rider/leash
But it may be as well a bash script