Allow a held-back package once from the app, releasing the waiting download

* Screen mirrors listed in the config file

* Reject config values the firewall cannot use

core/Cargo.toml

@@ -38,14 +38,17 @@ path = "src/main.rs"
 [[bin]]
 name = "firewall-service"
 path = "src/bin/firewall-service.rs"
+required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-tray"
 path = "src/bin/firewall-tray.rs"
+required-features = ["machine-wide"]
 
 [[bin]]
 name = "firewall-uninstall"
 path = "src/bin/firewall-uninstall.rs"
+required-features = ["machine-wide"]
 
 [[example]]
 name = "proxy-test"
@@ -87,6 +90,14 @@ path = "tests/tpm.rs"
 name = "managers"
 path = "tests/managers.rs"
 
+[[test]]
+name = "blocks"
+path = "tests/blocks.rs"
+
+[features]
+# Builds the machine-wide binaries: the Windows service and tray, and the macOS uninstaller.
+machine-wide = []
+
 [dependencies]
 clap = "4.6.6"
 directories = "6.0.0"
@@ -118,7 +129,7 @@ schannel = "0.1.29"
 tokio = { version = "1.53.1", features = ["net"] }
 tracing-appender = "0.2.5"
 tray-icon = { version = "0.26.1", default-features = false }
-windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_System_Com", "Win32_System_Environment", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
+windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Security_Cryptography", "Win32_Storage_FileSystem", "Win32_System_Com", "Win32_System_Console", "Win32_System_Environment", "Win32_System_JobObjects", "Win32_System_Threading", "Win32_UI_Shell", "Win32_UI_WindowsAndMessaging"] }
 windows-registry = "0.6.1"
 windows-service = "0.8.0"
 

core/src/aliasing/mod.rs

@@ -1,5 +1,7 @@
 pub mod forward;
 pub mod managers;
+#[cfg(windows)]
+mod windows;
 
 pub use forward::spawn;
 pub use managers::*;
@@ -34,7 +36,8 @@ impl Invocation {
 
 pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::Result<i32> {
     let proxy = crate::local_url(port, "");
-    let mut command = Command::new(resolve(&invocation.program)?);
+    let program = resolve(&invocation.program)?;
+    let mut command = Command::new(&program);
     command.args(invocation.arguments(&proxy));
     if let Some(dir) = dir {
         command.current_dir(dir);
@@ -42,7 +45,12 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
     for (key, value) in managers::variables(&proxy) {
         command.env(key, value);
     }
-    Ok(command.status()?.code().unwrap_or(1))
+    #[cfg(windows)]
+    windows::prepare();
+    let status = command.status();
+    #[cfg(windows)]
+    let status = status.map_err(|error| windows::explain(error, &program));
+    Ok(status?.code().unwrap_or(1))
 }
 
 // Command::new only finds .exe on Windows; npm, pnpm and gem are .cmd shims found via PATHEXT.

core/src/aliasing/windows.rs

@@ -0,0 +1,64 @@
+use std::io::{Error, ErrorKind};
+use std::path::Path;
+use std::sync::Once;
+use tracing::debug;
+use windows::core::{BOOL, PCWSTR};
+use windows::Win32::System::Console::{SetConsoleCtrlHandler, CTRL_BREAK_EVENT, CTRL_C_EVENT};
+use windows::Win32::System::JobObjects::{
+    AssignProcessToJobObject, CreateJobObjectW, JobObjectExtendedLimitInformation,
+    SetInformationJobObject, JOBOBJECT_EXTENDED_LIMIT_INFORMATION,
+    JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
+};
+use windows::Win32::System::Threading::GetCurrentProcess;
+
+/// Called before spawning, so the manager behaves as it would run from the shell directly.
+/// Once per process: a caller may run several managers.
+pub fn prepare() {
+    static PREPARED: Once = Once::new();
+    PREPARED.call_once(|| {
+        // The console sends Ctrl+C to the manager too. Exiting first would hand the prompt back
+        // while a .cmd shim still asks "Terminate batch job (Y/N)?", so wait for its exit instead.
+        // A handler, unlike ignoring the signal outright, is not inherited by the manager.
+        let _ = unsafe { SetConsoleCtrlHandler(Some(ignore_interrupt), true) };
+        if let Err(error) = kill_children_on_exit() {
+            debug!(%error, "the manager may outlive the firewall");
+        }
+    });
+}
+
+unsafe extern "system" fn ignore_interrupt(event: u32) -> BOOL {
+    (event == CTRL_C_EVENT || event == CTRL_BREAK_EVENT).into()
+}
+
+/// Joins a job that kills what is left in it once the firewall exits, even if killed itself.
+/// The manager inherits the job when spawned, as do its own children.
+fn kill_children_on_exit() -> windows::core::Result<()> {
+    let mut limits = JOBOBJECT_EXTENDED_LIMIT_INFORMATION::default();
+    limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+    // Never closed: the handle closing as the firewall exits is what kills the rest.
+    let job = unsafe { CreateJobObjectW(None, PCWSTR::null())? };
+    unsafe {
+        SetInformationJobObject(
+            job,
+            JobObjectExtendedLimitInformation,
+            (&raw const limits).cast(),
+            size_of_val(&limits) as u32,
+        )?
+    };
+    unsafe { AssignProcessToJobObject(job, GetCurrentProcess()) }
+}
+
+/// Rust refuses to pass a line break to a batch file, where it would cut the command short.
+pub fn explain(error: Error, program: &Path) -> Error {
+    let batch = program
+        .extension()
+        .is_some_and(|ext| ext.eq_ignore_ascii_case("cmd") || ext.eq_ignore_ascii_case("bat"));
+    if !batch || error.kind() != ErrorKind::InvalidInput {
+        return error;
+    }
+    let name = program.file_name().unwrap_or(program.as_os_str()).to_string_lossy();
+    Error::new(
+        ErrorKind::InvalidInput,
+        format!("{name} is a batch file, which cannot be passed an argument with a line break"),
+    )
+}

core/src/blocks.rs

@@ -0,0 +1,151 @@
+use crate::config::{self, AllowedPackage};
+use crate::policies::Package;
+use crate::Firewall;
+use rama::error::BoxError;
+use serde::Serialize;
+use std::path::Path;
+use std::sync::Mutex;
+use std::time::{Duration, Instant};
+use tokio::sync::watch;
+
+/// So blocks can't pile up while no app collects them.
+const KEPT: usize = 50;
+/// Under pip's, pipenv's and pdm's 15 s read timeout, the shortest of the supported managers.
+const HOLD: Duration = Duration::from_secs(10);
+/// Only hold while an app is asking for blocks, so someone can answer.
+const WATCHED: Duration = Duration::from_secs(2);
+/// For a minute, so the rest of that install can fetch it too.
+const ONCE: Duration = Duration::from_secs(60);
+
+#[derive(Clone, Serialize)]
+pub struct BlockedPackage {
+    pub id: u64,
+    pub eco: &'static str,
+    pub name: String,
+    pub version: Option<String>,
+    pub filter: &'static str,
+    pub reason: String,
+}
+
+struct Blocks {
+    last_id: u64,
+    unsent: Vec<BlockedPackage>,
+    /// Age holds, the only blocks that can be allowed, each with what wakes its waiting downloads.
+    held: Vec<(BlockedPackage, watch::Sender<bool>)>,
+    polled: Option<Instant>,
+}
+
+static BLOCKS: Mutex<Blocks> =
+    Mutex::new(Blocks { last_id: 0, unsent: Vec::new(), held: Vec::new(), polled: None });
+
+/// Records a block and holds a new package's download for up to `HOLD`. Returns whether it was allowed.
+pub async fn block(eco: &'static str, pkg: &Package, filter: &'static str, reason: &str) -> bool {
+    let Some(mut answer) = record(eco, pkg, filter, reason) else {
+        return false;
+    };
+    let allowed = tokio::time::timeout(HOLD, answer.wait_for(|allowed| *allowed)).await;
+    matches!(allowed, Ok(Ok(_)))
+}
+
+/// The app's requests: `blocks`, `allow <id>` or `allow-once <id>`.
+/// An allow replies `late` if the download had stopped waiting.
+pub fn answer(firewall: &Firewall, config: &Path, request: &str) -> String {
+    if request == "blocks" {
+        return serde_json::to_string(&take()).expect("blocks serialize");
+    }
+    let result = match request.split_once(' ').map(|(verb, id)| (verb, id.parse())) {
+        Some(("allow", Ok(id))) => trust(firewall, config, id),
+        Some(("allow-once", Ok(id))) => allow_once(firewall, id),
+        _ => Err(format!("unknown message {request}").into()),
+    };
+    match result {
+        Ok(true) => "ok".to_owned(),
+        Ok(false) => "late".to_owned(),
+        Err(error) => format!("error: {error}"),
+    }
+}
+
+/// Hands each block over once.
+fn take() -> Vec<BlockedPackage> {
+    let mut blocks = lock();
+    blocks.polled = Some(Instant::now());
+    std::mem::take(&mut blocks.unsent)
+}
+
+fn record(
+    eco: &'static str,
+    pkg: &Package,
+    filter: &'static str,
+    reason: &str,
+) -> Option<watch::Receiver<bool>> {
+    let mut blocks = lock();
+    let watched = blocks.polled.is_some_and(|polled| polled.elapsed() < WATCHED);
+    let holds = filter == "age" && watched;
+    // A repeat fetch of a held package waits on the same answer.
+    let waiting = blocks.held.iter().find(|(held, wake)| {
+        wake.receiver_count() > 0 && held.eco == eco && held.name == pkg.name && held.version == pkg.version
+    });
+    if let (true, Some((_, wake))) = (holds, waiting) {
+        return Some(wake.subscribe());
+    }
+    blocks.last_id += 1;
+    let block = BlockedPackage {
+        id: blocks.last_id,
+        eco,
+        name: pkg.name.clone(),
+        version: pkg.version.clone(),
+        filter,
+        reason: reason.to_owned(),
+    };
+    push(&mut blocks.unsent, block.clone());
+    if filter != "age" {
+        return None;
+    }
+    let (wake, allowed) = watch::channel(false);
+    push(&mut blocks.held, (block, wake));
+    holds.then_some(allowed)
+}
+
+/// Also saved to the config, so it survives a restart.
+fn trust(firewall: &Firewall, config: &Path, id: u64) -> Result<bool, BoxError> {
+    let block = held(id)?;
+    let version = block.version.ok_or("only a version can be trusted")?;
+    config::allow(config, block.eco, &block.name, &version)?;
+    let package = AllowedPackage { name: block.name, version: Some(version) };
+    firewall.lift_age_check(block.eco, package, None);
+    Ok(release(id))
+}
+
+fn allow_once(firewall: &Firewall, id: u64) -> Result<bool, BoxError> {
+    let block = held(id)?;
+    let package = AllowedPackage { name: block.name, version: block.version };
+    firewall.lift_age_check(block.eco, package, Some(Instant::now() + ONCE));
+    Ok(release(id))
+}
+
+fn held(id: u64) -> Result<BlockedPackage, BoxError> {
+    let blocks = lock();
+    let held = blocks.held.iter().find(|(held, _)| held.id == id);
+    Ok(held.ok_or(format!("no new package was held back as {id}"))?.0.clone())
+}
+
+/// Returns whether a download was still waiting.
+fn release(id: u64) -> bool {
+    let blocks = lock();
+    let Some((_, wake)) = blocks.held.iter().find(|(held, _)| held.id == id) else {
+        return false;
+    };
+    wake.send_replace(true);
+    wake.receiver_count() > 0
+}
+
+fn push<T>(list: &mut Vec<T>, item: T) {
+    if list.len() == KEPT {
+        list.remove(0);
+    }
+    list.push(item);
+}
+
+fn lock() -> std::sync::MutexGuard<'static, Blocks> {
+    BLOCKS.lock().unwrap_or_else(|e| e.into_inner())
+}

core/src/config/mod.rs

@@ -1,28 +1,29 @@
-use crate::policies::registries::{Registry, BUILT_IN};
+use crate::policies::registries::{host_of, BUILT_IN};
 use directories::ProjectDirs;
+use rama::net::uri::Uri;
 use serde::Deserialize;
-use serde_json::{Map, Value};
+use serde_json::{json, Map, Value};
 use std::collections::HashMap;
 use std::io::{Error, ErrorKind};
-use std::path::PathBuf;
+use std::num::{NonZeroU16, NonZeroU64};
+use std::path::{Path, PathBuf};
 
 pub const DEFAULT_PORT: u16 = 8080;
 
 #[derive(Debug, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct FirewallConfig {
-    pub port: u16,
+    pub port: NonZeroU16,
     /// Allow a package when a filter could not check it.
     pub fail_open: bool,
     /// 0 turns the age check off.
     pub min_age_hours: u64,
     pub denylist: DenylistSource,
-    /// Packages never screened, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
+    /// Packages exempt from the age check, by ecosystem: `{"npm": [{"name": "left-pad"}]}`.
     pub allow: HashMap<String, Vec<AllowedPackage>>,
     pub telemetry: bool,
-    /// Not describable in the file yet, so this is always the built-in table.
-    #[serde(skip)]
-    pub registries: Vec<&'static Registry>,
+    /// Mirrors laid out like a built-in registry, by its name: `{"npm": ["https://npm.example.com/"]}`.
+    pub registries: HashMap<String, Vec<String>>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -40,19 +41,19 @@ pub struct DenylistSource {
     pub base: String,
     /// Polled for a new commit, which re-fetches every list in use.
     pub revision: String,
-    pub poll_secs: u64,
+    pub poll_secs: NonZeroU64,
 }
 
 impl Default for FirewallConfig {
     fn default() -> Self {
         FirewallConfig {
-            port: DEFAULT_PORT,
+            port: NonZeroU16::new(DEFAULT_PORT).unwrap(),
             fail_open: true,
-            min_age_hours: 0,
+            min_age_hours: 24,
             denylist: DenylistSource::default(),
             allow: HashMap::new(),
             telemetry: true,
-            registries: BUILT_IN.to_vec(),
+            registries: HashMap::new(),
         }
     }
 }
@@ -63,7 +64,7 @@ impl Default for DenylistSource {
             base: "https://raw.githubusercontent.com/usestrix/firewall-blocklist/main".into(),
             revision: "https://api.github.com/repos/usestrix/firewall-blocklist/commits/main"
                 .into(),
-            poll_secs: 10,
+            poll_secs: NonZeroU64::new(10).unwrap(),
         }
     }
 }
@@ -87,7 +88,8 @@ impl FirewallConfig {
             };
             let invalid = |e| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
             let layer: Value = serde_json::from_str(&text).map_err(invalid)?;
-            FirewallConfig::deserialize(&layer).map_err(invalid)?;
+            let config = FirewallConfig::deserialize(&layer).map_err(invalid)?;
+            check(&config).map_err(|e| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display())))?;
             let Value::Object(layer) = layer else {
                 unreachable!("a config parses only from an object");
             };
@@ -97,19 +99,7 @@ impl FirewallConfig {
     }
 
     pub fn local_url(&self, path: &str) -> String {
-        crate::local_url(self.port, path)
-    }
-
-    /// Without building a `Firewall`, which needs a runtime.
-    pub fn hosts(&self) -> Vec<&'static str> {
-        let mut hosts: Vec<&'static str> = Vec::new();
-        for registry in &self.registries {
-            let host = registry.host();
-            if !hosts.contains(&host) {
-                hosts.push(host);
-            }
-        }
-        hosts
+        crate::local_url(self.port.get(), path)
     }
 }
 
@@ -129,3 +119,71 @@ fn merge(base: &mut Map<String, Value>, top: Map<String, Value>) {
         }
     }
 }
+
+/// Adds an `allow` entry to the file, leaving the rest of it as written.
+pub fn allow(path: &Path, eco: &str, name: &str, version: &str) -> std::io::Result<()> {
+    let invalid = |e: String| Error::new(ErrorKind::InvalidData, format!("{}: {e}", path.display()));
+    let mut config = match std::fs::read_to_string(path) {
+        Ok(text) => serde_json::from_str(&text).map_err(|e| invalid(e.to_string()))?,
+        Err(e) if e.kind() == ErrorKind::NotFound => json!({}),
+        Err(e) => return Err(e),
+    };
+    if !config.is_object() {
+        return Err(invalid("not an object".into()));
+    }
+    let entry = json!({ "name": name, "version": version });
+    let entries = &mut config["allow"][eco];
+    if entries.is_null() {
+        *entries = Value::Array(Vec::new());
+    }
+    let Some(entries) = entries.as_array_mut() else {
+        return Err(invalid(format!("allow.{eco} is not a list")));
+    };
+    if !entries.contains(&entry) {
+        entries.push(entry);
+    }
+    if let Some(dir) = path.parent() {
+        std::fs::create_dir_all(dir)?;
+    }
+    std::fs::write(path, serde_json::to_string_pretty(&config)?)
+}
+
+/// What serde's types cannot say.
+fn check(config: &FirewallConfig) -> Result<(), String> {
+    // `Duration::hours` panics past this.
+    if config.min_age_hours > time::Duration::MAX.whole_hours() as u64 {
+        return Err(format!("{} hours is too long", config.min_age_hours));
+    }
+    for eco in config.allow.keys() {
+        if !BUILT_IN.iter().any(|r| r.eco == eco) {
+            return Err(format!("unknown ecosystem {eco:?} in allow"));
+        }
+    }
+    for url in [&config.denylist.base, &config.denylist.revision] {
+        if parse_url(url, &["http", "https"]).is_none() {
+            return Err(format!("{url:?} is not an http(s) URL"));
+        }
+    }
+    for (name, mirrors) in &config.registries {
+        if !BUILT_IN.iter().any(|r| r.name() == name) {
+            return Err(format!("no built-in registry is named {name}"));
+        }
+        if let Some(url) = mirrors.iter().find(|url| !is_mirror(url)) {
+            return Err(format!("{url}: a mirror is an https:// URL ending in /"));
+        }
+    }
+    Ok(())
+}
+
+/// No port or userinfo, as `host_of` is what gets intercepted.
+fn is_mirror(url: &str) -> bool {
+    let Some(uri) = parse_url(url, &["https"]) else { return false };
+    let bare_host = uri.host_str().is_some_and(|host| host == host_of(url));
+    bare_host && uri.query().is_none() && uri.fragment().is_none() && url.ends_with('/')
+}
+
+fn parse_url(url: &str, schemes: &[&str]) -> Option<Uri> {
+    let uri = Uri::parse(url).ok()?;
+    let has_host = uri.host_str().is_some_and(|host| !host.is_empty());
+    (has_host && schemes.contains(&uri.scheme_str()?)).then_some(uri)
+}

core/src/firewall.rs

@@ -1,4 +1,4 @@
-use crate::config::FirewallConfig;
+use crate::config::{AllowedPackage, FirewallConfig};
 use crate::policies::filters::age::Age;
 use crate::policies::filters::denylist::Denylist;
 use crate::policies::filters::osv::Osv;
@@ -6,11 +6,16 @@ use crate::policies::filters::Filter;
 use crate::policies::registries::*;
 use regex::Regex;
 use std::collections::HashMap;
+use std::sync::Mutex;
+use std::time::Instant;
 
 pub struct Firewall {
     pub config: FirewallConfig,
+    registries: Vec<&'static Registry>,
     patterns: HashMap<&'static str, Vec<Regex>>,
     filters: Vec<Box<dyn Filter>>,
+    /// Each lift expires at its time, or lasts until the firewall stops. Never saved.
+    age_lifted: Mutex<Vec<(String, AllowedPackage, Option<Instant>)>>,
 }
 
 impl Default for Firewall {
@@ -21,18 +26,19 @@ impl Default for Firewall {
 
 impl Firewall {
     pub fn new(config: FirewallConfig) -> Self {
+        let registries = with_mirrors(&config.registries);
         let mut patterns = HashMap::new();
-        for registry in &config.registries {
+        for registry in &registries {
             let compiled = registry.patterns.iter().map(|p| Regex::new(p.re).expect(p.re));
             patterns.insert(registry.prefix, compiled.collect());
         }
-        let ecosystems = config.registries.iter().map(|r| r.osv_name);
+        let ecosystems = registries.iter().map(|r| r.osv_name);
         let denylist = Denylist::new(config.denylist.clone(), ecosystems);
         let mut filters: Vec<Box<dyn Filter>> = vec![Box::new(denylist), Box::new(Osv)];
         if config.min_age_hours > 0 {
             filters.push(Box::new(Age::new(config.min_age_hours)));
         }
-        Firewall { config, patterns, filters }
+        Firewall { config, registries, patterns, filters, age_lifted: Mutex::default() }
     }
 
     pub fn match_on<'a>(
@@ -40,20 +46,27 @@ impl Firewall {
         url: &'a str,
         key: fn(&Registry) -> &'static str,
     ) -> Option<(&'static Registry, &'a str)> {
-        self.config.registries.iter().find_map(|r| url.strip_prefix(key(r)).map(|rest| (*r, rest)))
+        self.registries.iter().find_map(|r| url.strip_prefix(key(r)).map(|rest| (*r, rest)))
     }
 
     pub fn hosts(&self) -> Vec<&'static str> {
-        self.config.hosts()
+        let mut hosts: Vec<&'static str> = Vec::new();
+        for registry in &self.registries {
+            let host = registry.host();
+            if !hosts.contains(&host) {
+                hosts.push(host);
+            }
+        }
+        hosts
     }
 
     pub fn is_https_url(&self, url: &str) -> bool {
         let host = host_of(url);
-        self.config.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
+        self.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
     }
 
     pub fn is_index_url(&self, url: &str) -> bool {
-        self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
+        self.registries.iter().any(|r| r.index && r.host() == host_of(url))
     }
 
     pub fn resolve(&self, registry: &'static Registry, rest: &str) -> Resolved {
@@ -63,4 +76,29 @@ impl Firewall {
     pub fn filters(&self) -> &[Box<dyn Filter>] {
         &self.filters
     }
+
+    pub fn lift_age_check(&self, eco: &str, package: AllowedPackage, until: Option<Instant>) {
+        let mut lifted = self.age_lifted.lock().unwrap_or_else(|e| e.into_inner());
+        lifted.retain(|(_, _, until)| until.is_none_or(|until| until > Instant::now()));
+        lifted.push((eco.to_owned(), package, until));
+    }
+
+    pub fn age_check_lifted(&self, eco: &str, matches: impl Fn(&AllowedPackage) -> bool) -> bool {
+        let lifted = self.age_lifted.lock().unwrap_or_else(|e| e.into_inner());
+        lifted.iter().any(|(e, package, until)| {
+            e == eco && until.is_none_or(|until| until > Instant::now()) && matches(package)
+        })
+    }
+}
+
+/// The built-ins, then a copy of one per mirror. Leaked, as a `Registry` is `'static` everywhere.
+fn with_mirrors(mirrors: &HashMap<String, Vec<String>>) -> Vec<&'static Registry> {
+    let mut registries = BUILT_IN.to_vec();
+    for built_in in BUILT_IN {
+        for upstream in mirrors.get(built_in.name()).into_iter().flatten() {
+            let upstream = upstream.clone().leak();
+            registries.push(Box::leak(Box::new(Registry { upstream, ..(*built_in).clone() })));
+        }
+    }
+    registries
 }

core/src/lib.rs

@@ -1,4 +1,5 @@
 pub mod aliasing;
+pub mod blocks;
 pub mod config;
 pub mod firewall;
 pub mod http;

core/src/os/macos/mod.rs

@@ -5,7 +5,7 @@ mod uninstall;
 pub use uninstall::uninstall;
 
 use crate::config::FirewallConfig;
-use crate::{mitm, telemetry};
+use crate::{blocks, mitm, telemetry};
 use crate::Firewall;
 use rama::bytes::Bytes;
 use rama::error::BoxError;
@@ -39,6 +39,7 @@ const CONFIG_FILE: &str = "/Library/Application Support/Firewall/config.json";
 struct Handler {
     ca: Arc<mitm::CertificateAuthority>,
     hosts: Vec<&'static str>,
+    firewall: Arc<Firewall>,
     service: mitm::MitmService,
 }
 
@@ -58,7 +59,7 @@ impl TransparentProxyHandler for Handler {
         let message = String::from_utf8_lossy(&message).into_owned();
         Some(Bytes::from(match message.as_str() {
             "ca" => self.ca.pem.clone(),
-            other => format!("error: unknown message {other}"),
+            other => blocks::answer(&self.firewall, CONFIG_FILE.as_ref(), other),
         }))
     }
 
@@ -113,8 +114,8 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
     let signer: mitm::CaSigner = Arc::new(key);
     let ca = install::certificate_authority(&hosts, &*signer);
     let ca = Arc::new(ca.inspect_err(|_| telemetry::error("ca"))?);
-    let service = mitm::mitm_service(firewall, &ca, signer, None, exec);
-    Ok(Handler { ca, hosts, service })
+    let service = mitm::mitm_service(firewall.clone(), &ca, signer, None, exec);
+    Ok(Handler { ca, hosts, firewall, service })
 }
 
 /// stderr is invisible in a system extension, so events go to the unified log:

core/src/os/windows/ca.rs

@@ -11,6 +11,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 use tracing::warn;
 use windows::Win32::Security::Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT};
 use windows::Win32::Security::*;
+use windows::Win32::Storage::FileSystem::CreateDirectoryW;
 use windows_registry::Type;
 
 /// SYSTEM and admins write, users only read, so no one else can plant a CA for node.
@@ -65,25 +66,39 @@ pub fn load_or_create_ca(
     Ok(ca)
 }
 
-/// Created on first use, its owner and ACL reset every time. One a user made first, or a link,
+/// Created on first use with its ACL, which is reset every time. One a user made first, or a link,
 /// is replaced: its owner could grant itself access again, and a link would redirect our writes.
 pub(super) fn secure_data_dir() -> io::Result<PathBuf> {
     let dir = data_dir();
-    match std::fs::symlink_metadata(&dir) {
-        Ok(meta) if meta.file_type().is_symlink() => std::fs::remove_dir(&dir)?,
+    let exists = match std::fs::symlink_metadata(&dir) {
+        Ok(meta) if meta.file_type().is_symlink() => {
+            std::fs::remove_dir(&dir)?;
+            false
+        }
         Ok(_) if !owned_by_admins(&dir)? => {
             warn!(dir = %dir.display(), "replacing a data folder not created by an admin");
-            std::fs::remove_dir_all(&dir)?
+            std::fs::remove_dir_all(&dir)?;
+            false
         }
-        _ => {}
-    }
-    std::fs::create_dir_all(&dir)?;
+        Ok(_) => true,
+        Err(_) => false,
+    };
     let info = OWNER_SECURITY_INFORMATION
         | DACL_SECURITY_INFORMATION
         | PROTECTED_DACL_SECURITY_INFORMATION;
     let path = HSTRING::from(dir.as_path());
     let acl = security_descriptor(DATA_DIR_ACL)?;
-    unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    if exists {
+        unsafe { SetFileSecurityW(&path, info, PSECURITY_DESCRIPTOR(acl.0)).ok()? };
+    } else {
+        let attributes = SECURITY_ATTRIBUTES {
+            nLength: size_of::<SECURITY_ATTRIBUTES>() as u32,
+            lpSecurityDescriptor: acl.0,
+            bInheritHandle: false.into(),
+        };
+        // Never inherits ProgramData's ACL, which lets users add files; fails if it was recreated.
+        unsafe { CreateDirectoryW(&path, Some(&attributes))? };
+    }
     Ok(dir)
 }
 

core/src/os/windows/service.rs

@@ -26,6 +26,7 @@ use std::net::{IpAddr, Ipv4Addr};
 use std::sync::Arc;
 use std::time::Duration;
 use tracing_appender::rolling::{RollingFileAppender, Rotation};
+use windows::Win32::Foundation::ERROR_GEN_FAILURE;
 use windows_service::service::*;
 use windows_service::service_control_handler::{
     self, ServiceControlHandlerResult, ServiceStatusHandle,
@@ -73,8 +74,12 @@ fn run_until_stopped() -> Result<(), BoxError> {
         | ServiceControl::Shutdown
         | ServiceControl::Pause
         | ServiceControl::Continue => {
-            let _ = control_sender.send(control);
-            ServiceControlHandlerResult::NoError
+            // Answered once handled, so a failed pause fails the caller's ControlService.
+            let (reply, handled) = tokio::sync::oneshot::channel();
+            let _ = control_sender.send((control, reply));
+            handled
+                .blocking_recv()
+                .unwrap_or(ServiceControlHandlerResult::NoError)
         }
         ServiceControl::Interrogate => ServiceControlHandlerResult::NoError,
         _ => ServiceControlHandlerResult::NotImplemented,
@@ -89,16 +94,26 @@ fn run_until_stopped() -> Result<(), BoxError> {
             }
         };
         // Only pausing removes our hosts entries; a stop or crash keeps them, failing closed.
-        while let Some(control) = control_receiver.recv().await {
+        while let Some((control, reply)) = control_receiver.recv().await {
             let (hosts, state) = match control {
                 ServiceControl::Pause => (&[][..], ServiceState::Paused),
                 ServiceControl::Continue => (&hosts[..], ServiceState::Running),
                 _ => break,
             };
-            match write_hosts_entries(hosts) {
-                Ok(()) => set_status(&status, state, false)?,
-                Err(error) => tracing::error!(%error, "could not rewrite the hosts file"),
-            }
+            let result = match write_hosts_entries(hosts) {
+                Ok(()) => {
+                    set_status(&status, state, false)?;
+                    ServiceControlHandlerResult::NoError
+                }
+                Err(error) => {
+                    tracing::error!(%error, "could not rewrite the hosts file");
+                    let code = error
+                        .raw_os_error()
+                        .map_or(ERROR_GEN_FAILURE.0, |code| code as u32);
+                    ServiceControlHandlerResult::Other(code)
+                }
+            };
+            let _ = reply.send(result);
         }
         Ok::<_, BoxError>(())
     });
@@ -147,7 +162,7 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
                 resolver: resolver.clone(),
                 service: service.clone(),
             };
-            let upstream = ConsumeErrLayer::trace_as_debug().into_layer(upstream);
+            let upstream = ConsumeErrLayer::trace_as_warning().into_layer(upstream);
             tokio::spawn(listen_on(address, port, &exec)?.serve(upstream));
         }
     }

core/src/os/windows/tray.rs

@@ -144,7 +144,11 @@ impl Tray {
 }
 
 fn show_error(error: BoxError) {
-    let text = HSTRING::from(error.to_string());
+    let text = match error.source() {
+        Some(source) => format!("{error}: {source}"),
+        None => error.to_string(),
+    };
+    let text = HSTRING::from(text);
     unsafe { MessageBoxW(None, &text, w!("Strix Firewall"), MB_ICONERROR) };
 }
 

core/src/policies/filters/denylist.rs

@@ -143,7 +143,7 @@ pub fn describe(advisories: &[&Advisory]) -> String {
 
 /// A failed fetch leaves the last good list in place; a list that never loaded is retried every tick.
 async fn watch(source: DenylistSource, lists: Arc<Lists>) {
-    let period = Duration::from_secs(source.poll_secs);
+    let period = Duration::from_secs(source.poll_secs.get());
     let mut seen = revision(&source, None).await;
     loop {
         tokio::time::sleep(period).await;

core/src/policies/filters/mod.rs

@@ -3,6 +3,7 @@ pub mod denylist;
 pub mod osv;
 
 use super::registries::{Package, Registry};
+use crate::config::AllowedPackage;
 use crate::Firewall;
 use std::future::Future;
 use std::pin::Pin;
@@ -25,16 +26,19 @@ pub trait Filter: Send + Sync {
 }
 
 /// Asks every filter. A `Deny` wins; failing that, the first filter that could not tell.
+/// An allowed package skips only the age check, so malware is never let through.
 pub async fn consult(
     firewall: &Firewall,
     registry: &'static Registry,
     pkg: &Package,
 ) -> Option<(&'static str, Verdict)> {
-    if allowed(firewall, registry, pkg) {
-        return None;
-    }
+    let lifted = allowed(firewall, registry, pkg)
+        || firewall.age_check_lifted(registry.eco, |entry| matches(registry, pkg, entry));
     let mut unsure = None;
     for filter in firewall.filters() {
+        if lifted && filter.name() == "age" {
+            continue;
+        }
         match filter.check(registry, pkg).await {
             Verdict::Allow => continue,
             Verdict::Deny(reason) => return Some((filter.name(), Verdict::Deny(reason))),
@@ -49,13 +53,15 @@ fn allowed(firewall: &Firewall, registry: &Registry, pkg: &Package) -> bool {
     let Some(entries) = firewall.config.allow.get(registry.eco) else {
         return false;
     };
-    entries.iter().any(|entry| {
-        let name_matches = match registry.normalize {
-            Some(normalize) => normalize(&entry.name) == pkg.name,
-            None => entry.name == pkg.name,
-        };
-        // Go writes a leading v that the parsed version drops, and PEP 440 ignores one.
-        let version = entry.version.as_deref().map(|v| v.strip_prefix('v').unwrap_or(v));
-        name_matches && (version.is_none() || version == pkg.version.as_deref())
-    })
+    entries.iter().any(|entry| matches(registry, pkg, entry))
+}
+
+fn matches(registry: &Registry, pkg: &Package, entry: &AllowedPackage) -> bool {
+    let name_matches = match registry.normalize {
+        Some(normalize) => normalize(&entry.name) == pkg.name,
+        None => entry.name == pkg.name,
+    };
+    // Go writes a leading v that the parsed version drops, and PEP 440 ignores one.
+    let version = entry.version.as_deref().map(|v| v.strip_prefix('v').unwrap_or(v));
+    name_matches && (version.is_none() || version == pkg.version.as_deref())
 }

core/src/policies/mod.rs

@@ -69,7 +69,11 @@ pub async fn screen(url: &str, firewall: &Firewall) -> Option<String> {
     };
     info!(eco = registry.eco, pkg = %pkg.label(), %url, "screening");
     match consult(firewall, registry, &pkg).await {
-        Some((_, Verdict::Deny(reason))) => {
+        Some((filter, Verdict::Deny(reason))) => {
+            if crate::blocks::block(registry.eco, &pkg, filter, &reason).await {
+                info!(eco = registry.eco, pkg = %pkg.label(), "allowed while held");
+                return None;
+            }
             Some(format!("{} {reason}", pkg.label()))
         }
         Some((filter, Verdict::Unknown(e))) if !firewall.config.fail_open => {

core/src/policies/registries/mod.rs

@@ -36,7 +36,7 @@ pub struct Pattern {
 }
 
 /// Requests to the local server match on `prefix`; intercepted URLs match on `upstream`.
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub struct Registry {
     pub prefix: &'static str,
     pub eco: &'static str,
@@ -52,7 +52,7 @@ pub struct Registry {
 }
 
 /// A URL to fetch and a JSON pointer to the timestamp in its reply.
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub struct Published {
     pub url: &'static str,
     pub pointer: &'static str,
@@ -63,6 +63,11 @@ impl Registry {
     pub fn host(&self) -> &'static str {
         host_of(self.upstream)
     }
+
+    /// What the config file calls it.
+    pub fn name(&self) -> &'static str {
+        self.prefix.trim_matches('/')
+    }
 }
 
 /// The host of an https:// URL, with the path dropped.

core/src/proxy/mod.rs

@@ -15,7 +15,7 @@ use std::sync::Arc;
 use tracing::{info, info_span, warn, Instrument};
 
 pub fn serve(config: FirewallConfig) -> std::io::Result<()> {
-    let bound = std::net::TcpListener::bind(("127.0.0.1", config.port))?;
+    let bound = std::net::TcpListener::bind(("127.0.0.1", config.port.get()))?;
     bound.set_nonblocking(true)?;
     crate::runtime()?.block_on(async move {
         let firewall = Arc::new(Firewall::new(config));

core/tests/blocks.rs

@@ -0,0 +1,27 @@
+use firewall::blocks::{answer, block};
+use firewall::policies::Package;
+use firewall::Firewall;
+use std::path::Path;
+use std::time::Duration;
+
+#[tokio::test]
+async fn allowing_once_releases_the_held_download() {
+    let firewall = Firewall::default();
+    let config = Path::new("/nonexistent/config.json");
+    let pkg = Package { name: "left-pad".into(), version: Some("1.3.0".into()) };
+    assert!(!block("npm", &pkg, "age", "is new").await, "held while nothing was asking");
+    answer(&firewall, config, "blocks");
+
+    let held = tokio::spawn(async move { block("npm", &pkg, "age", "is new").await });
+    let id = loop {
+        let blocks: serde_json::Value = serde_json::from_str(&answer(&firewall, config, "blocks")).unwrap();
+        if let Some(id) = blocks[0]["id"].as_u64() {
+            break id;
+        }
+        tokio::time::sleep(Duration::from_millis(10)).await;
+    };
+    assert_eq!(answer(&firewall, config, &format!("allow-once {id}")), "ok");
+    assert!(held.await.unwrap(), "the waiting download goes through");
+    assert!(firewall.age_check_lifted("npm", |p| p.name == "left-pad"), "and the rest of the install");
+    assert!(!block("npm", &Package { name: "evil".into(), version: None }, "denylist", "is malware").await);
+}

core/tests/config.rs

@@ -1,4 +1,4 @@
-use firewall::config::path;
+use firewall::config::{path, AllowedPackage};
 use firewall::policies::filters::consult;
 use firewall::policies::{screen, Package};
 use firewall::{Firewall, FirewallConfig};
@@ -7,7 +7,7 @@ use firewall::{Firewall, FirewallConfig};
 fn a_file_only_has_to_set_what_it_changes() {
     let config: FirewallConfig = serde_json::from_str(r#"{"fail_open": false}"#).expect("parses");
     assert!(!config.fail_open);
-    assert_eq!(config.port, firewall::DEFAULT_PORT);
+    assert_eq!(config.port.get(), firewall::DEFAULT_PORT);
 }
 
 #[test]
@@ -15,6 +15,28 @@ fn a_misspelled_setting_is_an_error() {
     assert!(serde_json::from_str::<FirewallConfig>(r#"{"fail-open": false}"#).is_err());
 }
 
+#[test]
+fn nonsense_values_are_errors() {
+    let file = std::env::temp_dir().join(format!("firewall-nonsense-{}.json", std::process::id()));
+    for bad in [
+        r#"{"allow": {"nmp": [{"name": "left-pad"}]}}"#,
+        r#"{"denylist": {"poll_secs": 0}}"#,
+        r#"{"denylist": {"base": "raw.githubusercontent.com/usestrix"}}"#,
+        r#"{"denylist": {"revision": "https://"}}"#,
+        r#"{"port": 0}"#,
+        r#"{"min_age_hours": 18446744073709551615}"#,
+        r#"{"registries": {"npm": ["http://npm.example.com/"]}}"#,
+        r#"{"registries": {"npm": ["https://npm.example.com"]}}"#,
+        r#"{"registries": {"npm": ["https://npm.example.com:8443/"]}}"#,
+        r#"{"registries": {"npm": ["https://[email protected]/"]}}"#,
+        r#"{"registries": {"npm": ["https://npm.example.com/?a=/"]}}"#,
+    ] {
+        std::fs::write(&file, bad).expect("write");
+        assert!(FirewallConfig::load_from(std::slice::from_ref(&file)).is_err(), "{bad}");
+    }
+    std::fs::remove_file(&file).ok();
+}
+
 #[test]
 fn the_config_lives_under_the_config_directory() {
     let path = path().expect("a home directory");
@@ -39,14 +61,29 @@ fn a_later_file_wins_and_allow_lists_add_up() {
 }
 
 #[tokio::test]
-async fn an_allowed_version_skips_the_filters() {
-    // An unreachable denylist would otherwise leave the package unchecked.
+async fn a_mirror_is_screened_like_the_registry_it_copies() {
+    let config = r#"{"registries": {"npm": ["https://npm.example.com/"]}}"#;
+    let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
+    assert!(firewall.hosts().contains(&"npm.example.com"));
+    let url = "https://npm.example.com/left-pad/-/left-pad-1.3.0.tgz";
+    let (registry, rest) = firewall.match_on(url, |r| r.upstream).expect("the mirror");
+    assert_eq!(firewall.resolve(registry, rest).pkg.map(|p| p.label()), Some("[email protected]".into()));
+    let unknown = std::env::temp_dir().join(format!("firewall-mirror-{}.json", std::process::id()));
+    std::fs::write(&unknown, r#"{"registries": {"nmp": ["https://npm.example.com/"]}}"#).expect("write");
+    let loaded = FirewallConfig::load_from(std::slice::from_ref(&unknown));
+    std::fs::remove_file(&unknown).ok();
+    assert!(loaded.is_err());
+}
+
+#[tokio::test]
+async fn an_allowed_version_is_still_checked_for_malware() {
+    // The unreachable denylist shows that it still runs.
     let config = r#"{"allow": {"go": [{"name": "golang.org/x/net", "version": "v0.20.0"}]}, "denylist": {"base": "http://127.0.0.1:1"}}"#;
     let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
     let (registry, _) = firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
-    let pkg = |version: &str| Package { name: "golang.org/x/net".into(), version: Some(version.into()) };
-    assert!(consult(&firewall, registry, &pkg("0.20.0")).await.is_none());
-    assert!(consult(&firewall, registry, &pkg("0.21.0")).await.is_some());
+    let pkg = Package { name: "golang.org/x/net".into(), version: Some("0.20.0".into()) };
+    let verdict = consult(&firewall, registry, &pkg).await;
+    assert_eq!(verdict.map(|(filter, _)| filter), Some("denylist"));
 }
 
 #[tokio::test]
@@ -57,3 +94,29 @@ async fn failing_closed_blocks_what_could_not_be_checked() {
     let blocked = screen(url, &firewall).await.unwrap_or_default();
     assert!(blocked.contains("could not be checked"), "{blocked:?}");
 }
+
+#[tokio::test]
+async fn lifting_the_age_check_still_checks_for_malware() {
+    let config = r#"{"denylist": {"base": "http://127.0.0.1:1"}}"#;
+    let firewall = Firewall::new(serde_json::from_str(config).expect("parses"));
+    let (registry, _) = firewall.match_on("/go/golang.org/x/net/@v/list", |r| r.prefix).expect("go");
+    let pkg = Package { name: "golang.org/x/net".into(), version: Some("0.20.0".into()) };
+    firewall.lift_age_check("go", AllowedPackage { name: pkg.name.clone(), version: None }, None);
+    let (filter, _) = consult(&firewall, registry, &pkg).await.expect("the denylist still runs");
+    assert_eq!(filter, "denylist");
+}
+
+#[test]
+fn allowing_keeps_the_rest_of_the_file() {
+    let path = std::env::temp_dir().join(format!("firewall-allow-{}.json", std::process::id()));
+    std::fs::write(&path, r#"{"fail_open": false}"#).expect("write");
+    for _ in 0..2 {
+        firewall::config::allow(&path, "npm", "left-pad", "1.3.0").expect("allow");
+    }
+    let text = std::fs::read_to_string(&path).expect("read");
+    std::fs::remove_file(&path).ok();
+    let config: FirewallConfig = serde_json::from_str(&text).expect("parses");
+    assert!(!config.fail_open);
+    assert_eq!(config.allow["npm"].len(), 1);
+    assert_eq!(config.allow["npm"][0].version.as_deref(), Some("1.3.0"));
+}

dist-workspace.toml

@@ -7,6 +7,7 @@ ci = "github"
 installers = ["shell", "powershell", "homebrew", "msi"]
 # core/wix/main.wxs is edited to install the service.
 allow-dirty = ["msi"]
+features = ["machine-wide"]
 tap = "usestrix/homebrew-tap"
 publish-jobs = ["homebrew", "./publish-crates"]
 targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]

macos/App/BlockAlerts.swift

@@ -0,0 +1,77 @@
+import AppKit
+import Security
+
+struct BlockedPackage: Codable, Hashable, Identifiable {
+    let id: UInt64
+    let eco: String
+    let name: String
+    let version: String?
+    let filter: String
+    let reason: String
+
+    var label: String { version.map { "\(name) \($0)" } ?? name }
+    /// The denylist and OSV only flag packages known to be malicious; the age check only holds back new ones.
+    var malicious: Bool { filter != "age" }
+    /// Malware is never allowed, and a new package only by version.
+    var trustable: Bool { !malicious && version != nil }
+}
+
+enum Allowance {
+    /// For a minute, so the rest of that install can fetch it too.
+    case once
+    case always
+}
+
+@MainActor
+enum BlockAlert {
+    static func show(_ package: BlockedPackage) -> Allowance? {
+        let alert = NSAlert()
+        alert.addButton(withTitle: "OK")
+        if package.malicious {
+            alert.alertStyle = .critical
+            alert.messageText = "Blocked malware: \(package.label) (\(package.eco))"
+            alert.informativeText = "\(package.label) \(package.reason).\n\n"
+                + "It was not installed. Don't install it from another source. "
+                + "If you didn't expect this package, a dependency may be compromised; tell your security team."
+        } else {
+            alert.messageText = "Held back a new package"
+            alert.informativeText = "\(package.label) (\(package.eco)) \(package.reason)."
+            if package.trustable {
+                alert.addButton(withTitle: "Allow Once")
+                alert.addButton(withTitle: "Trust this version")
+            }
+        }
+        NSApp.activate(ignoringOtherApps: true)
+        switch alert.runModal() {
+        case .alertSecondButtonReturn: return .once
+        case .alertThirdButtonReturn: return .always
+        default: return nil
+        }
+    }
+
+    static func late(_ package: BlockedPackage, _ allowance: Allowance) {
+        let alert = NSAlert()
+        alert.messageText = allowance == .once ? "Allowed \(package.label) for the next minute" : "Trusted \(package.label)"
+        alert.informativeText = "The install had already stopped waiting for it. Run it again to finish."
+        NSApp.activate(ignoringOtherApps: true)
+        alert.runModal()
+    }
+}
+
+enum AdminAuthorization {
+    /// The allowlist applies to every user of the Mac, so changing it takes an admin, as `sudo` would.
+    static func confirm() -> Bool {
+        var authorization: AuthorizationRef?
+        guard AuthorizationCreate(nil, nil, [], &authorization) == errAuthorizationSuccess,
+              let authorization else { return false }
+        defer { AuthorizationFree(authorization, []) }
+        return "system.preferences".withCString { name in
+            var item = AuthorizationItem(name: name, valueLength: 0, value: nil, flags: 0)
+            return withUnsafeMutablePointer(to: &item) { item in
+                var rights = AuthorizationRights(count: 1, items: item)
+                let flags: AuthorizationFlags = [.interactionAllowed, .extendRights]
+                return AuthorizationCopyRights(authorization, &rights, nil, flags, nil) == errAuthorizationSuccess
+            }
+        }
+    }
+}

macos/App/FirewallModel.swift

@@ -29,11 +29,13 @@ enum FirewallError: Error, LocalizedError {
     case extensionUnavailable
     case screeningDidNotStart(NEVPNStatus)
     case extensionStopped(String)
+    case extensionRefused(String)
 
     var errorDescription: String? {
         switch self {
         case .extensionUnavailable: return "The extension is not running"
         case let .screeningDidNotStart(status): return "Screening did not start (\(status.label))"
+        case let .extensionRefused(reply): return "The extension replied \(reply)"
         case let .extensionStopped(reason):
             return "The extension stopped: \(reason). Its log: log show --last 5m --predicate 'subsystem BEGINSWITH \"\(FirewallIDs.appBundleID)\"'"
         }
@@ -51,6 +53,7 @@ final class FirewallModel: NSObject, ObservableObject {
     @Published private(set) var completed = false
     @Published private(set) var removed = false
     @Published private(set) var screening = false
+    @Published private(set) var blocked: [BlockedPackage] = []
 
     private let logger = Logger(subsystem: FirewallIDs.appBundleID, category: "installer")
     private var pendingRequest: (request: OSSystemExtensionRequest, continuation: CheckedContinuation<Void, Error>)?
@@ -72,6 +75,7 @@ final class FirewallModel: NSObject, ObservableObject {
             await refresh()
             if CommandLine.arguments.contains("--install") { await install() }
         }
+        Task { await watchBlocks() }
     }
 
     // MARK: - Flows
@@ -199,6 +203,39 @@ final class FirewallModel: NSObject, ObservableObject {
         if let url = URL(string: pane) { NSWorkspace.shared.open(url) }
     }
 
+    /// Trusting changes the config for every user, so it takes an admin.
+    func allow(_ package: BlockedPackage, _ allowance: Allowance) async {
+        guard package.trustable else { return }
+        if allowance == .always, !AdminAuthorization.confirm() {
+            log("Trust cancelled for \(package.label)")
+            return
+        }
+        do {
+            let reply = try await providerMessage("\(allowance == .once ? "allow-once" : "allow") \(package.id)")
+            guard reply == "ok" || reply == "late" else { throw FirewallError.extensionRefused(reply) }
+            blocked.removeAll { $0 == package }
+            log("Allowed \(package.label) (\(package.eco)) \(allowance)")
+            if reply == "late" { BlockAlert.late(package, allowance) }
+        } catch {
+            log("Could not allow \(package.label): \(error.localizedDescription)")
+        }
+    }
+
+    /// The extension cannot message the app, so the app asks it for blocks.
+    private func watchBlocks() async {
+        while true {
+            if screening, let reply = try? await providerMessage("blocks"),
+               let packages = try? JSONDecoder().decode([BlockedPackage].self, from: Data(reply.utf8)) {
+                for package in packages where !blocked.contains(package) {
+                    blocked.append(package)
+                    if let allowance = BlockAlert.show(package) { await allow(package, allowance) }
+                }
+                blocked = Array(blocked.suffix(10))
+            }
+            try? await Task.sleep(nanoseconds: 500_000_000)
+        }
+    }
+
     private func stage(_ step: ReferenceWritableKeyPath<FirewallModel, StepStatus>,
                        running: String,
                        work: @MainActor () async throws -> String) async -> Bool {

macos/App/MenuBarView.swift

@@ -22,5 +22,28 @@ struct MenuBarView: View {
             Task { await model.restart() }
         }
         .disabled(model.busy)
+
+        if !model.blocked.isEmpty {
+            Divider()
+            ForEach(model.blocked) { package in
+                if !package.malicious {
+                    Menu("Held back \(package.label) (\(package.eco))") {
+                        Text(package.reason)
+                        Button("Allow Once") {
+                            Task { await model.allow(package, .once) }
+                        }
+                        .disabled(model.busy || !package.trustable)
+                        Button("Trust this version") {
+                            Task { await model.allow(package, .always) }
+                        }
+                        .disabled(model.busy || !package.trustable)
+                    }
+                } else {
+                    Menu("Blocked \(package.label) (\(package.eco))") {
+                        Text("Malicious: \(package.reason)")
+                    }
+                }
+            }
+        }
     }
 }

macos/project.yml

@@ -133,7 +133,7 @@ targets:
               arm64|arm64e) triple=aarch64-apple-darwin ;;
               x86_64)       triple=x86_64-apple-darwin ;;
             esac
-            cargo build --bin firewall-uninstall --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
+            cargo build --bin firewall-uninstall --features machine-wide --target $triple $([ "$CONFIGURATION" = Debug ] || echo --release)
             bins="$bins target/$triple/$CARGO_PROFILE/firewall-uninstall"
           done
           lipo -create $bins -output "$TARGET_BUILD_DIR/$EXECUTABLE_FOLDER_PATH/firewall-uninstall"