4 ms·
Can you elaborate? Read, write, execute privileges on files and directories goes a long way. What's missing? The biggest is Internet access, or networking in
by jimbokun 2mo ago
Can you elaborate?
Read, write, execute privileges on files and directories goes a long way. What's missing?
The biggest is Internet access, or networking in general, I suppose.
- cryptonector 2mo agoTwo problems. First, it is remarkably difficult to come up with a set of programs that it is safe to let the restricted user use. Second, it is remarkably difficult to make the restricted environment useful enough if you're really serious about allowing only safe programs to be used. Try to make it useful enough and you end up with escapes everywhere.
- jimbokun 2mo agoSure but then the file protections also apply to the programs used by the agent. If you can strictly limit the agent to only modifying files in the source code directory of a single repository, that greatly limits the blast radius of damage.
- cryptonector 2mo agoBut that's not useful. That's the problem.