No description
- Go 92.9%
- Shell 7.1%
Robert Hurst
8a951e785d
- daemon: include working_dir and stdin (truncated) in elicitation prompt and %q-quote args so payloads hidden behind interpreters (bash -s, python -, tee, etc.) are visible to the approver - daemon: log AUDIT line when validation rejects a request - policy: add shells, interpreters, exec wrappers (sh/bash/python/ perl/node/awk/xargs/env/su/sudo/doas/chroot/unshare/nsenter/ systemd-run/busybox/find/tee/sponge/...) to sensitiveCommands so the heuristic isn't trivially bypassed via wrapper invocations - daemon: drop unused ApprovalDecision.Note (never populated; schema didn't expose it) - sudoers: pin secure_path explicitly instead of relying on sudo's compile-time default - install.sh: build binaries via 'sudo -u $CLIENT_USER go build' when bin/ is missing, instead of failing with a stale hint |
||
|---|---|---|
| cmd | ||
| internal/elevated | ||
| sudoers | ||
| systemd | ||
| .gitignore | ||
| go.mod | ||
| go.sum | ||
| install.sh | ||