jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-07 23:42:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(runtime): bind native filesystem operations to resource identities

Browse Source
This commit is contained in:
Alexandre Teixeira
2026-10-02 01:19:32 +01:00
parent 7aa891e5e6
commit ba3e631d58
8 changed files with 1393 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_tool_path_confinement.py
+6 -3
View File
@@ -252,7 +252,8 @@ async def test_read_file_dispatch_blocks_etc_shadow(monkeypatch):
owner="admin-user",
security_context=NO_TOOL_SECURITY_CONTEXT,
)
assert "outside the allowed roots" in (result.get("error") or "")
assert result.get("failure_kind") == "resource_identity_denied"
assert "sealed resource root" in (result.get("error") or "")
assert result.get("exit_code") == 1
@@ -281,7 +282,8 @@ async def test_write_file_dispatch_blocks_authorized_keys(monkeypatch):
owner="admin-user",
security_context=NO_TOOL_SECURITY_CONTEXT,
)
assert "sensitive directory" in (result.get("error") or "")
assert result.get("failure_kind") == "resource_identity_denied"
assert "sealed resource root" in (result.get("error") or "")
assert result.get("exit_code") == 1
@@ -344,7 +346,8 @@ async def test_write_file_dispatch_blocks_cron(monkeypatch):
owner="admin-user",
security_context=NO_TOOL_SECURITY_CONTEXT,
)
assert "outside the allowed roots" in (result.get("error") or "")
assert result.get("failure_kind") == "resource_identity_denied"
assert "sealed resource root" in (result.get("error") or "")
assert result.get("exit_code") == 1
@pytest.mark.parametrize("filename", ["auth.json", "app.db", "settings.json"])
def test_application_secrets_are_sensitive_paths(filename):