kernel-zero/kernel-zero.python.policy.json at main · AP3X-Dev/kernel-zero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
{
  "apiVersion": "kernel-zero.dev/v1",
  "kind": "PythonPolicy",
  "metadata": {
    "name": "python-analyzer-boundaries",
    "revision": 1,
    "description": "Govern the bundled CPython AST adapter with its own Python profile."
  },
  "scope": {
    "include": [
      "packages/profile-python/python-analyzer.py"
    ],
    "exclude": []
  },
  "rules": [
    {
      "id": "no-process-execution",
      "title": "Python analyzer cannot launch processes",
      "level": "error",
      "check": {
        "kind": "forbid-import-edge",
        "from": [
          "packages/profile-python/python-analyzer.py"
        ],
        "deny": [
          "subprocess"
        ]
      },
      "remediation": "Keep execution ownership in the Node runner."
    },
    {
      "id": "required-ast-import",
      "title": "Python analyzer uses CPython AST",
      "level": "error",
      "check": {
        "kind": "require-import",
        "files": [
          "packages/profile-python/python-analyzer.py"
        ],
        "module": "ast"
      },
      "remediation": "Parse Python with the standard-library ast module."
    },
    {
      "id": "no-dynamic-execution",
      "title": "Python analyzer cannot dynamically execute source",
      "level": "error",
      "check": {
        "kind": "restrict-call-site",
        "callee": [
          "eval",
          "exec"
        ],
        "allowFrom": []
      },
      "remediation": "Inspect syntax through ast without evaluating source."
    },
    {
      "id": "analysis-source-boundary",
      "title": "Analysis entry point requires source",
      "level": "error",
      "check": {
        "kind": "require-context-parameter",
        "files": [
          "packages/profile-python/python-analyzer.py"
        ],
        "symbols": "analyze",
        "parameter": "source"
      },
      "remediation": "Keep source as an explicit required analysis input."
    }
  ]
}