unkin-agent
9958b5557e
Refuse launch dirs overlapping sensitive dirs under every root
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:56:54 +11:00
unkin-agent
80c90769fd
Refuse roots and launch dirs overlapping forbidden system dirs
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:49:13 +11:00
unkin-agent
f60caa7e98
Refuse launch dirs holding $PATH entries and mount the checked path
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:43:06 +11:00
unkin-agent
bbc439fb09
Merge remote-tracking branch 'origin/benvin/go-launcher' into benvin/launch-dir-allowlist
2026-10-24 17:38:48 +11:00
unkin-agent
a2a4eb31ca
Merge remote-tracking branch 'origin/benvin/go-launcher' into benvin/launch-dir-allowlist
...
# Conflicts:
# main_test.go
2026-10-24 17:37:57 +11:00
unkin-agent
3f1cc9644d
Merge benvin/go-launcher
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:33:03 +11:00
unkin-agent
90c7412194
Trust listed roots under dot-dirs, reject sensitive ones
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:11:33 +11:00
unkin-agent
3ec134147a
Allow launches only under configured roots
...
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Replace the launch-dir denylist with an allowlist of roots from
allowed-paths (default $HOME), always refusing $HOME dot-dirs and
invalid roots under /run, /tmp, /var/tmp, /proc, /sys or /dev.
2026-10-24 17:05:33 +11:00
unkin-agent