58f0e5ab74
As described in detail in `codex-rs/execpolicy/README.md` introduced in
this PR, `execpolicy` is a tool that lets you define a set of _patterns_
used to match [`execv(3)`](https://linux.die.net/man/3/execv)
invocations. When a pattern is matched, `execpolicy` returns the parsed
version in a structured form that is amenable to static analysis.
The primary use case is to define patterns match commands that should be
auto-approved by a tool such as Codex. This supports a richer pattern
matching mechanism that the sort of prefix-matching we have done to
date, e.g.:
5e40d9d221/codex-cli/src/approvals.ts (L333-L354)
Note we are still playing with the API and the `system_path` option in
particular still needs some work.
46 lines
1.1 KiB
Rust
46 lines
1.1 KiB
Rust
#![allow(clippy::type_complexity)]
|
|
#![allow(clippy::too_many_arguments)]
|
|
#[macro_use]
|
|
extern crate starlark;
|
|
|
|
mod arg_matcher;
|
|
mod arg_resolver;
|
|
mod arg_type;
|
|
mod error;
|
|
mod exec_call;
|
|
mod execv_checker;
|
|
mod opt;
|
|
mod policy;
|
|
mod policy_parser;
|
|
mod program;
|
|
mod sed_command;
|
|
mod valid_exec;
|
|
|
|
pub use arg_matcher::ArgMatcher;
|
|
pub use arg_resolver::PositionalArg;
|
|
pub use arg_type::ArgType;
|
|
pub use error::Error;
|
|
pub use error::Result;
|
|
pub use exec_call::ExecCall;
|
|
pub use execv_checker::ExecvChecker;
|
|
pub use opt::Opt;
|
|
pub use policy::Policy;
|
|
pub use policy_parser::PolicyParser;
|
|
pub use program::Forbidden;
|
|
pub use program::MatchedExec;
|
|
pub use program::NegativeExamplePassedCheck;
|
|
pub use program::PositiveExampleFailedCheck;
|
|
pub use program::ProgramSpec;
|
|
pub use sed_command::parse_sed_command;
|
|
pub use valid_exec::MatchedArg;
|
|
pub use valid_exec::MatchedFlag;
|
|
pub use valid_exec::MatchedOpt;
|
|
pub use valid_exec::ValidExec;
|
|
|
|
const DEFAULT_POLICY: &str = include_str!("default.policy");
|
|
|
|
pub fn get_default_policy() -> starlark::Result<Policy> {
|
|
let parser = PolicyParser::new("#default", DEFAULT_POLICY);
|
|
parser.parse()
|
|
}
|