I'm sorry but the idea of giving an AI agent a non-restricted shell is insane. If you don't want it to perform certain commands those commands should not be in its environment at all.
Allowlisting some Bash commands is often the same as allowlisting all
21–27 of 27 posts
Re: Allowlisting some Bash commands is often the same as allowlisting all
#22I remember when I was starting out, someone on my team showed me, that in the case where we were allowed to run vi and root on a machine there was noting stopping one from just starting a child shell from within vi with root privileges.
Re: Allowlisting some Bash commands is often the same as allowlisting all
#23Same thing for allowing specific sudo-commands. Many tools (like vim or the tools mentioned in the article) would have the same problem when allowing them to be run with root privileges.
=> https://gtfobins.org/
Now I feel a bit more justified for over-engineering my automatic restic backup to not run as root, but to instead use "capabilities" to read files it doesn't own.
Namely, CAP_DAC_READ_SEARCH [0] and related systemd settings. The only problem is that it inhibits using a convenience/wrapper script.
[0] https://www.man7.org/linux/man-pages/man7/capabilities.7.htm...
Re: Allowlisting some Bash commands is often the same as allowlisting all
#24Not entirely related to the content but man 'allowlisting' reads so badly. We should just out of ease of reading return to whitelisting.
Re: Allowlisting some Bash commands is often the same as allowlisting all
#25Not entirely related to the content but man 'allowlisting' reads so badly. We should just out of ease of reading return to whitelisting.
I'm trying not to get nerdsniped, but in the realm of subjective pragmatics, I personally find `allowlisting` to be drastically more clear.
Re: Allowlisting some Bash commands is often the same as allowlisting all
#26everything is a container these days, and yet somehow collective-we don't manage to have AI agents run in a container layer on top of our current work, so we can later commit or rollback?
What do you mean?! Where? I would claim otherwise: 99% of software is not in the containers. Like 100% windows or debian software
I don't know much about how windows software is packaged, but I find that a solid majority of desktop software I use is in flatpack and server software in OCI images
Re: Allowlisting some Bash commands is often the same as allowlisting all
#27Not entirely related to the content but man 'allowlisting' reads so badly. We should just out of ease of reading return to whitelisting.
I'm trying not to get nerdsniped, but in the realm of subjective pragmatics, I personally find `allowlisting` to be drastically more clear.
My concern isn't really clarity of intention, but that 'allowlisting' just doesn't flow as well when reading as whitelisting does.