zara-shell: validate allowed program/root policy descriptors eagerly #114

New issue

Closed

opened 2026-09-08 02:03:00 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:00 +00:00

Owner

Problem

CommandPolicy validates environment names and numeric bounds but does not validate the element types/content of allowed_programs or allowed_roots. Malformed policy values can survive construction and later leak incidental TypeError/path conversion behavior from ShellRunner instead of failing at the policy boundary.

Slice

deterministic RED coverage for malformed allowed program/root descriptors;
reject them during CommandPolicy construction with explicit policy errors;
no execution-path widening and no change to Core cancellation requirements;
full plugin/registry/Nix verification before merge.

Dependency-ready correctness slice within #5.

## Problem `CommandPolicy` validates environment names and numeric bounds but does not validate the element types/content of `allowed_programs` or `allowed_roots`. Malformed policy values can survive construction and later leak incidental `TypeError`/path conversion behavior from `ShellRunner` instead of failing at the policy boundary. ## Slice - deterministic RED coverage for malformed allowed program/root descriptors; - reject them during `CommandPolicy` construction with explicit policy errors; - no execution-path widening and no change to Core cancellation requirements; - full plugin/registry/Nix verification before merge. Dependency-ready correctness slice within #5.

nsaspy closed this issue

2026-09-08 02:03:00 +00:00