1use serde::{Deserialize, Serialize};
2
3use crate::constants::commands as command_constants;
4
5#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]
7#[derive(Debug, Clone, Deserialize, Serialize)]
8pub struct CommandsConfig {
9 #[serde(default)]
11 pub allow_list: Vec<String>,
12
13 #[serde(default = "default_extra_path_entries")]
15 pub extra_path_entries: Vec<String>,
16
17 #[serde(default)]
19 pub deny_list: Vec<String>,
20
21 #[serde(default)]
23 pub allow_glob: Vec<String>,
24
25 #[serde(default)]
27 pub deny_glob: Vec<String>,
28
29 #[serde(default)]
31 pub allow_regex: Vec<String>,
32
33 #[serde(default)]
35 pub deny_regex: Vec<String>,
36}
37
38const DEFAULT_ALLOW_LIST: &[&str] = &[
39 "ls",
40 "pwd",
41 "cat",
42 "grep",
43 "find",
44 "head",
45 "tail",
46 "wc",
47 "git status",
48 "git diff",
49 "git log",
50 "git show",
51 "git branch",
52 "git remote",
53 "cargo check",
54 "cargo build",
55 "cargo build --release",
56 "cargo build --profile release",
57 "cargo test",
58 "cargo run",
59 "cargo clippy",
60 "cargo fmt",
61 "cargo tree",
62 "cargo metadata",
63 "cargo doc",
64 "rustc",
65 "which",
66 "echo",
67 "printf",
68 "date",
69 "tree",
70 "stat",
71 "file",
72 "sort",
73 "uniq",
74 "cut",
75 "awk",
76 "sed",
77 "tar",
78 "zip",
79 "unzip",
80 "gzip",
81 "gunzip",
82 "make",
83 "cmake",
84 "ninja",
85 "python3",
86 "python3 -m pip install",
87 "python3 -m pytest",
88 "python3 -m build",
89 "python",
90 "pip3",
91 "pip",
92 "virtualenv",
93 "node",
94 "npm",
95 "npm run build",
96 "npm run test",
97 "npm install",
98 "yarn",
99 "yarn build",
100 "yarn test",
101 "pnpm",
102 "pnpm build",
103 "pnpm test",
104 "bun",
105 "bun install",
106 "bun run",
107 "bun test",
108 "npx",
109 "go",
110 "go build",
111 "go test",
112 "gcc",
113 "g++",
114 "clang",
115 "clang++",
116 "javac",
117 "java",
118 "mvn",
119 "gradle",
120 "docker",
121 "docker-compose",
122];
123
124impl Default for CommandsConfig {
125 fn default() -> Self {
126 Self {
127 allow_list: DEFAULT_ALLOW_LIST.iter().map(|s| (*s).into()).collect(),
128 extra_path_entries: default_extra_path_entries(),
129 deny_list: vec![
130 "rm -rf /".into(),
131 "rm -rf ~".into(),
132 "rm -rf /*".into(),
133 "rm -rf /home".into(),
134 "rm -rf /usr".into(),
135 "rm -rf /etc".into(),
136 "rm -rf /var".into(),
137 "rm -rf /opt".into(),
138 "rmdir /".into(),
139 "rmdir /home".into(),
140 "rmdir /usr".into(),
141 "shutdown".into(),
142 "reboot".into(),
143 "halt".into(),
144 "poweroff".into(),
145 "init 0".into(),
146 "init 6".into(),
147 "systemctl poweroff".into(),
148 "systemctl reboot".into(),
149 "systemctl halt".into(),
150 "sudo rm".into(),
151 "sudo chmod 777".into(),
152 "sudo chown".into(),
153 "sudo passwd".into(),
154 "sudo su".into(),
155 "sudo -i".into(),
156 "sudo bash".into(),
157 "su root".into(),
158 "su -".into(),
159 "format".into(),
160 "fdisk".into(),
161 "mkfs".into(),
162 "mkfs.ext4".into(),
163 "mkfs.xfs".into(),
164 "mkfs.vfat".into(),
165 "dd if=/dev/zero".into(),
166 "dd if=/dev/random".into(),
167 "dd if=/dev/urandom".into(),
168 "wget --no-check-certificate".into(),
169 ":(){ :|:& };:".into(), "nohup bash -i".into(),
171 "exec bash -i".into(),
172 "eval".into(),
173 "source /etc/bashrc".into(),
174 "source ~/.bashrc".into(),
175 "chmod 777".into(),
176 "chmod -R 777".into(),
177 "chown -R".into(),
178 "chgrp -R".into(),
179 "rm ~/.ssh/*".into(),
180 "rm -r ~/.ssh".into(),
181 "cat /etc/passwd".into(),
182 "cat /etc/shadow".into(),
183 "cat ~/.ssh/id_*".into(),
184 "tail -f /var/log".into(),
185 "head -n 1 /var/log".into(),
186 ],
187 allow_glob: vec![
188 "git *".into(),
189 "cargo *".into(),
190 "rustc *".into(),
191 "python *".into(),
192 "python3 *".into(),
193 "pip *".into(),
194 "pip3 *".into(),
195 "node *".into(),
196 "npm *".into(),
197 "npm run *".into(),
198 "yarn *".into(),
199 "yarn run *".into(),
200 "pnpm *".into(),
201 "pnpm run *".into(),
202 "bun *".into(),
203 "bun run *".into(),
204 "npx *".into(),
205 "go *".into(),
206 "gcc *".into(),
207 "g++ *".into(),
208 "clang *".into(),
209 "clang++ *".into(),
210 "javac *".into(),
211 "java *".into(),
212 "mvn *".into(),
213 "gradle *".into(),
214 "make *".into(),
215 "cmake *".into(),
216 "ninja *".into(),
217 "docker *".into(),
218 "docker-compose *".into(),
219 "virtualenv *".into(),
220 "tar *".into(),
221 "zip *".into(),
222 "unzip *".into(),
223 "gzip *".into(),
224 "gunzip *".into(),
225 ],
226 deny_glob: vec![
227 "rm *".into(),
228 "sudo *".into(),
229 "chmod *".into(),
230 "chown *".into(),
231 "kill *".into(),
232 "pkill *".into(),
233 "systemctl *".into(),
234 "service *".into(),
235 "mount *".into(),
236 "umount *".into(),
237 "docker run *".into(),
238 "kubectl *".into(),
239 ],
240 allow_regex: vec![
241 r"^(ls|pwd|cat|grep|find|head|tail|wc|echo|printf|date|tree|stat|file|sort|uniq|cut|awk|sed|tar|zip|unzip|gzip|gunzip)\b".into(),
242 r"^git (status|diff|log|show|branch|remote)\b".into(),
243 r"^cargo (check|build|test|run|doc|clippy|fmt|tree|metadata)\b".into(),
244 r"^rustc\b".into(),
245 r"^(python|python3) (-m | )?\w*".into(),
246 r"^(pip|pip3)\b".into(),
247 r"^virtualenv\b".into(),
248 r"^(node|npm|yarn|pnpm|bun|npx)\b".into(),
249 r"^go\b".into(),
250 r"^(gcc|g\+\+|clang|clang\++)\b".into(),
251 r"^(javac|java)\b".into(),
252 r"^(mvn|gradle)\b".into(),
253 r"^(make|cmake)\b".into(),
254 r"^(docker|docker-compose)\b".into(),
255 ],
256 deny_regex: vec![
257 r"rm\s+(-rf|--force)".into(),
258 r"sudo\s+.*".into(),
259 r"chmod\s+.*".into(),
260 r"chown\s+.*".into(),
261 r"docker\s+run\s+.*--privileged".into(),
262 r"kubectl\s+(delete|drain|uncordon)".into(),
263 ],
264 }
265 }
266}
267
268fn default_extra_path_entries() -> Vec<String> {
269 command_constants::DEFAULT_EXTRA_PATH_ENTRIES
270 .iter()
271 .map(|value| (*value).into())
272 .collect()
273}