7 lines
4.1 KiB
JavaScript
7 lines
4.1 KiB
JavaScript
import{c as a,Q as s,j as t,m as i}from"./chunks/framework.BPKcPtvA.js";const u=JSON.parse('{"title":"L3a: L4 Whitelist Hook","description":"","frontmatter":{},"headers":[],"relativePath":"labs/l3-whitelist-hook.md","filePath":"labs/l3-whitelist-hook.md","lastUpdated":null}'),l={name:"labs/l3-whitelist-hook.md"};function n(o,e,r,p,h,c){return s(),t("div",null,[...e[0]||(e[0]=[i(`<h1 id="l3a-l4-whitelist-hook" tabindex="-1">L3a: L4 Whitelist Hook <a class="header-anchor" href="#l3a-l4-whitelist-hook" aria-label="Permalink to "L3a: L4 Whitelist Hook""></a></h1><p>Implement a production-grade L4 security whitelist hook.</p><p><strong>Module</strong>: M3 Safety & Security<br><strong>Est. Time</strong>: 60 min<br><strong>Files</strong>: <code>starter.py</code>, <code>solution.py</code></p><h2 id="objective" tabindex="-1">Objective <a class="header-anchor" href="#objective" aria-label="Permalink to "Objective""></a></h2><p>Block ALL bash commands except 10 safelisted patterns. This prevents the L3 marque break (agent writing and running scripts).</p><h2 id="concepts" tabindex="-1">Concepts <a class="header-anchor" href="#concepts" aria-label="Permalink to "Concepts""></a></h2><ul><li>L4 whitelist (architectural security)</li><li>Regex pattern matching</li><li>Compound shell operator detection</li><li>Defense in depth</li></ul><h2 id="starter" tabindex="-1">Starter <a class="header-anchor" href="#starter" aria-label="Permalink to "Starter""></a></h2><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">cd</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> course/labs/L3-whitelist-hook/</span></span>
|
||
<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">python</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> starter.py</span></span></code></pre></div><p>The starter has:</p><ol><li>A safelist patterns list (currently empty)</li><li>A compound operators detector (currently empty)</li><li>A whitelist check function (currently TODO)</li><li>Test cases for both ALLOWED and BLOCKED commands</li></ol><h2 id="solution" tabindex="-1">Solution <a class="header-anchor" href="#solution" aria-label="Permalink to "Solution""></a></h2><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">python</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> solution.py</span></span></code></pre></div><h2 id="key-design-rules" tabindex="-1">Key Design Rules <a class="header-anchor" href="#key-design-rules" aria-label="Permalink to "Key Design Rules""></a></h2><ol><li>Pin specific scripts: <code>^npm test$</code> not <code>^npm .*$</code></li><li>Never pattern-match an interpreter: <code>^python .*$</code> allows running any script</li><li>Block compound operators before regex</li><li>Audit log all blocks</li></ol><h2 id="test-cases" tabindex="-1">Test Cases <a class="header-anchor" href="#test-cases" aria-label="Permalink to "Test Cases""></a></h2><div class="language- vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang"></span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span>npm test → ALLOW</span></span>
|
||
<span class="line"><span>git status → ALLOW</span></span>
|
||
<span class="line"><span>rm -rf target/ → BLOCK</span></span>
|
||
<span class="line"><span>python cleanup.py → BLOCK (L3 marque break)</span></span>
|
||
<span class="line"><span>npm test && rm -rf / → BLOCK (compound operator)</span></span></code></pre></div>`,17)])])}const k=a(l,[["render",n]]);export{u as __pageData,k as default};
|