lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

services_hardening_bounded_process.v1.json (2389B)

      1 {
      2   "schema": "radroots.services-hardening.bounded-process-decisions.v1",
      3   "contract_version": 1,
      4   "decision_state": "active",
      5   "owner": "tools/xtask",
      6   "self_test_command": "cargo xtask bounded-process-self-test",
      7   "platform_scope": {
      8     "implementation": [
      9       "macos_aarch64",
     10       "linux_x86_64"
     11     ],
     12     "source_gate": [
     13       "macos_aarch64"
     14     ],
     15     "cross_platform_promotion_owner": "step-297"
     16   },
     17   "process_model": {
     18     "child_process_group": "new_group_with_child_as_leader",
     19     "stdin": "closed_devnull",
     20     "stdout": "concurrently_drained_live_byte_cap",
     21     "stderr": "concurrently_drained_live_byte_cap",
     22     "deadline_clock": "monotonic",
     23     "normal_leader_exit": "clean_remaining_process_group",
     24     "failure_cleanup": "term_group_bounded_grace_then_kill_group_and_bounded_reap",
     25     "unsupported_platform": "fail_closed"
     26   },
     27   "hard_maximums": {
     28     "deadline_seconds": 86400,
     29     "termination_grace_seconds": 5,
     30     "stdout_bytes": 67108864,
     31     "stderr_bytes": 67108864,
     32     "environment_entries": 64,
     33     "environment_name_bytes": 128,
     34     "environment_value_bytes": 65536
     35   },
     36   "environment": {
     37     "inheritance": "replace_with_explicit_allowlist",
     38     "ambient_snapshot": false,
     39     "duplicate_name": "reject",
     40     "invalid_name_or_nul": "reject",
     41     "forbidden_names": [
     42       "CARGO_ENCODED_RUSTFLAGS",
     43       "DYLD_INSERT_LIBRARIES",
     44       "DYLD_LIBRARY_PATH",
     45       "LD_LIBRARY_PATH",
     46       "LD_PRELOAD",
     47       "NIX_CONFIG",
     48       "NIX_PATH",
     49       "NIXPKGS_ALLOW_BROKEN",
     50       "NIXPKGS_ALLOW_UNFREE",
     51       "RUSTFLAGS"
     52     ],
     53     "forbidden_name_patterns": [
     54       "*CREDENTIAL*",
     55       "*KEY*",
     56       "*PASSWORD*",
     57       "*SECRET*",
     58       "*TOKEN*"
     59     ],
     60     "equivalent_build_controls": [
     61       "CARGO_BUILD_RUSTFLAGS",
     62       "CARGO_TARGET_*_RUSTFLAGS",
     63       "DYLD_*",
     64       "LD_AUDIT",
     65       "LD_DEBUG",
     66       "LD_PROFILE",
     67       "RUSTC_WRAPPER",
     68       "RUSTC_WORKSPACE_WRAPPER",
     69       "RUSTDOCFLAGS"
     70     ]
     71   },
     72   "diagnostic_safety": {
     73     "program_argv_cwd": "redacted",
     74     "environment_values": "redacted",
     75     "captured_stream_bytes": "redacted",
     76     "operating_system_error_text": "redacted",
     77     "source_error_chain": "absent"
     78   },
     79   "required_vectors": [
     80     "timeout",
     81     "orphan_child",
     82     "stdout_cap",
     83     "stderr_cap",
     84     "closed_stdin",
     85     "inherited_build_environment",
     86     "loader_injection",
     87     "redaction"
     88   ]
     89 }