1package tools
2
3import (
4 "errors"
5 "fmt"
6 "path/filepath"
7 "strings"
8
9 "github.com/patriceckhart/zot/packages/core"
10)
11
12// PermissionSet is the local-runtime permission contract for a packaged .zot agent.
13type PermissionSet struct {
14 FS struct {
15 Read []string `json:"read"`
16 Write []string `json:"write"`
17 } `json:"fs"`
18 Bash struct {
19 Mode string `json:"mode"`
20 Allow []string `json:"allow"`
21 } `json:"bash"`
22 Net struct {
23 Allow []string `json:"allow"`
24 } `json:"net"`
25 Env struct {
26 Read []string `json:"read"`
27 } `json:"env"`
28}
29
30// Expand resolves manifest variables into absolute local paths.
31func (p PermissionSet) Expand(workspace, agentData string) PermissionSet {
32 expand := func(s string) string {
33 s = strings.ReplaceAll(s, "${workspace}", workspace)
34 s = strings.ReplaceAll(s, "${agent_data}", agentData)
35 if !filepath.IsAbs(s) && s != "" {
36 s = filepath.Join(workspace, s)
37 }
38 return s
39 }
40 // Clone the slices before expanding them. PermissionSet is copied by value,
41 // but slices otherwise still alias the manifest and repeated expansion (for
42 // example after /cd) would mutate the original declaration.
43 p.FS.Read = append([]string(nil), p.FS.Read...)
44 p.FS.Write = append([]string(nil), p.FS.Write...)
45 for i, v := range p.FS.Read {
46 p.FS.Read[i] = expand(v)
47 }
48 for i, v := range p.FS.Write {
49 p.FS.Write[i] = expand(v)
50 }
51 return p
52}
53
54func (s *Sandbox) SetPermissions(p *PermissionSet) {
55 if s == nil {
56 return
57 }
58 s.Permissions = p
59}
60
61func (s *Sandbox) CheckReadPath(path string) (err error) {
62 defer markPolicyError(&err)
63 if err := s.CheckPath(path); err != nil {
64 return err
65 }
66 if s == nil || s.Permissions == nil {
67 return nil
68 }
69 if len(s.Permissions.FS.Read) == 0 {
70 return fmt.Errorf("permission denied: this agent has no filesystem read permission")
71 }
72 return checkScopedPath("read", path, s.Permissions.FS.Read)
73}
74
75func (s *Sandbox) CheckWritePath(path string) (err error) {
76 defer markPolicyError(&err)
77 if err := s.CheckPath(path); err != nil {
78 return err
79 }
80 if s == nil || s.Permissions == nil {
81 return nil
82 }
83 if len(s.Permissions.FS.Write) == 0 {
84 return fmt.Errorf("permission denied: this agent has no filesystem write permission")
85 }
86 return checkScopedPath("write", path, s.Permissions.FS.Write)
87}
88
89func checkScopedPath(op, path string, scopes []string) error {
90 target, err := canonicalOrParent(path)
91 if err != nil {
92 return fmt.Errorf("permission path: %w", err)
93 }
94 for _, scope := range scopes {
95 root, err := canonicalOrParent(scope)
96 if err != nil {
97 continue
98 }
99 if isUnder(root, target) {
100 return nil
101 }
102 }
103 return fmt.Errorf("permission denied: %s %q is outside declared scopes", op, path)
104}
105
106func (s *Sandbox) CheckBashPermission(cmd string) (err error) {
107 defer markPolicyError(&err)
108 if s == nil || s.Permissions == nil {
109 return nil
110 }
111 mode := strings.ToLower(strings.TrimSpace(s.Permissions.Bash.Mode))
112 if mode == "" {
113 mode = "none"
114 }
115 switch mode {
116 case "none":
117 return fmt.Errorf("permission denied: this agent has no bash permission")
118 case "ask":
119 // The local runtime obtains explicit consent for this capability at
120 // every launch. Unlike durable consent, ask mode is never cached.
121 return nil
122 case "allowlist":
123 if strings.ContainsAny(cmd, "`\n\r<>") || strings.Contains(cmd, "$(") {
124 return fmt.Errorf("permission denied: bash allowlist does not permit substitution or redirection")
125 }
126 names := commandNames(cmd)
127 if len(names) == 0 {
128 return fmt.Errorf("permission denied: empty command")
129 }
130 allowed := map[string]bool{}
131 for _, name := range s.Permissions.Bash.Allow {
132 allowed[filepath.Base(strings.TrimSpace(name))] = true
133 }
134 for _, name := range names {
135 if !allowed[name] {
136 return fmt.Errorf("permission denied: bash command %q is not in allowlist", name)
137 }
138 }
139 return nil
140 default:
141 return fmt.Errorf("permission denied: unsupported bash mode %q", mode)
142 }
143}
144
145// Keep the original error text and errors.Is identity while marking denials
146// for lifecycle observers. Nested jail and manifest checks wrap only once.
147func markPolicyError(err *error) {
148 var policy *core.ToolPolicyError
149 if *err != nil && !errors.As(*err, &policy) {
150 *err = &core.ToolPolicyError{Err: *err}
151 }
152}
153
154func commandNames(cmd string) []string {
155 cmd = strings.NewReplacer("&&", ";", "||", ";", "|", ";").Replace(cmd)
156 parts := strings.Split(cmd, ";")
157 var out []string
158 for _, part := range parts {
159 name := firstCommandName(part)
160 if name == "" || name == "cd" {
161 continue
162 }
163 out = append(out, name)
164 }
165 return out
166}
167
168func firstCommandName(cmd string) string {
169 cmd = strings.TrimSpace(cmd)
170 if cmd == "" {
171 return ""
172 }
173 fields := strings.Fields(cmd)
174 if len(fields) == 0 {
175 return ""
176 }
177 name := fields[0]
178 for strings.Contains(name, "=") && len(fields) > 1 {
179 fields = fields[1:]
180 name = fields[0]
181 }
182 return filepath.Base(strings.Trim(name, "'\""))
183}