Heretek-Games/flatpark
1
0
Fork 0
mirror of https://github.com/Heretek-Games/flatpark.git synced 2026-10-12 02:05:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(audit): exempt declared sandbox-escape perms from hard fail

Browse Source 
An escape permission listed in policy.dangerous_permissions is an explicit,
reviewed exemption; downgrade it from FAIL to WARN so it stays visible without
blocking the gate. Undeclared escape perms still hard-fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
Komh
2026-07-08 11:34:38 +08:00
co-authored by Claude Opus 4.8
parent a1ed6f7e23
commit 8bd8539c84
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pr-review.md
+3 -2
View File
@@ -73,8 +73,9 @@ artifact provenance tier (1/2/3).
only); `archive` → `sha256` + genuine-upstream URL; `extra-data` → `sha256` +
non-zero `size`; `file` → local, reviewed as part of the PR; other → NEEDS-HUMAN.
- **finish-args risk scan:** near-auto-reject on escape perms
(`--talk-name=org.freedesktop.Flatpak`, `--filesystem=host`, `--filesystem=/`);
warn on `--device=all`, `--filesystem=home`, needless `--share=network`.
(`--talk-name=org.freedesktop.Flatpak`, `--filesystem=host`, `--filesystem=/`)
unless declared in `policy.dangerous_permissions` (then a reviewed exemption →
warn); warn on `--device=all`, `--filesystem=home`, needless `--share=network`.
- **`policy:` block vs reality:** `proprietary` accurate; `dangerous_permissions`
covers the high-risk finish-args actually used (hard enforcement deferred — see
guardrail G2(b)).
scripts/audit-descriptor.mjs
+6 -1
View File
@@ -172,7 +172,12 @@ const ESCAPE = ['--talk-name=org.freedesktop.Flatpak', '--filesystem=host', '--f
// G2(b) — broad perms must be declared in policy.dangerous_permissions (warn until schema lands).
const WATCH = ['--device=all', '--filesystem=home'];
for (const fa of finishArgs) {
if (ESCAPE.includes(fa)) fail(`sandbox-escape permission: ${fa}`);
if (ESCAPE.includes(fa)) {
// A declared escape permission is an explicit, reviewed exemption: downgrade
// the hard fail to a warning so it stays visible without blocking the gate.
if (dangerousPerms.includes(fa)) warn(`sandbox-escape permission ${fa} (declared in policy.dangerous_permissions)`);
else fail(`sandbox-escape permission: ${fa}`);
}
if (WATCH.includes(fa) && !dangerousPerms.includes(fa)) {
warn(`dangerous permission ${fa} not declared in policy.dangerous_permissions`);
}