mirror of
https://github.com/deepseek-ai/deepseek-harness
synced 2026-08-15 21:04:50 +00:00
f64ba40f43
Confine Windows command execution through a WRITE_RESTRICTED token whose restricting SIDs carry an orphan-SID write allowlist, ported from https://github.com/huoyaoyuan/windows-acl-restrict-poc (@ 10e4dfb). Every Win32 call is checked and fails closed - the POC silently ran children with the FULL token when CreateRestrictedToken failed. - @deepseek-ai/dsh-sandbox-windows-acl: koffi primitives verified against the MinGW Windows headers (verify/abi-probe.cpp) plus the confinement runner ([node, runner, --workspace, --temp, --mode, --, argv...]: kill-on-close job, stdio passthrough, exit-code mirroring, windows-acl-run: failure signature, grant revocation). read-only = strict zero grants (NUL device not writable; documented). Windows-only execution: exempted from the Linux coverage lane (windowsOnlyCoverageExclusions). - @deepseek-ai/dsh-sandbox-local: PLATFORM_CHAINS.win32 filled with the windows-acl runner (full enforcement, ACL denial dialect, runner-failure rules). - @deepseek-ai/dsh-pwsh-sandbox: sandbox-consuming pwsh executor (call-for-call mirror of dsh-bash-sandbox) over a new argv-level seam in dsh-pwsh-local; per-file coverage complete via the fake-provider spec. - bundle/base: the Windows platform layer mounts the confined pwsh roster - sandbox/policy/fs-sandbox/permission/approval re-enabled, the POSIX bash stack stays disabled. Co-authored-by: Huo Yaoyuan <huoyaoyuan@hotmail.com>
33 lines
1.3 KiB
YAML
33 lines
1.3 KiB
YAML
# The dsh-base Windows platform layer: applied by the dsh launcher on win32
|
|
# hosts, between the bundle layers and the user layers. Windows confines
|
|
# through the ACL restricted-token runner (the win32 chain of
|
|
# dsh-sandbox-local → @deepseek-ai/dsh-sandbox-windows-acl), so the shipped
|
|
# stack is the SANDBOXED PowerShell executor plus the full permission
|
|
# surface: sandbox/sandbox-policy enforce the file-effect policy, the
|
|
# permission switcher and the approval service run exactly as on POSIX, and
|
|
# fs-sandbox fences the in-process filesystem view. Only the POSIX bash
|
|
# stack (bash-sandbox/tool-bash) is disabled — bash has no Windows runner.
|
|
# A Windows host that prefers the unconfined local pwsh executor or full
|
|
# access overrides these rows through its profile or home cordis.patch.yml.
|
|
# The bash-restore recipe must be complete: disable pwsh-sandbox and
|
|
# tool-pwsh AND re-enable bash-sandbox and tool-bash — both executor
|
|
# families register the same 'bash' service, so re-enabling the bash rows
|
|
# while pwsh-sandbox stays inserted fails loud at load on a duplicate
|
|
# registration.
|
|
|
|
- id: bash-sandbox
|
|
disabled: true
|
|
|
|
- id: tool-bash
|
|
disabled: true
|
|
|
|
- insert:
|
|
- id: pwsh-sandbox
|
|
name: '@deepseek-ai/dsh-pwsh-sandbox'
|
|
|
|
- id: tool-pwsh
|
|
name: '@deepseek-ai/dsh-tool-pwsh'
|
|
|
|
- id: fs-local
|
|
name: '@deepseek-ai/dsh-fs-local'
|