SEChrome/config.example.yaml at main · XuanwuLab/SEChrome · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# Secure Chrome Launcher Configuration
# This file controls the behavior of the secure launcher, including
# security mechanisms, logging, and access control rules.

# --- General Settings ---

# Path to the Chrome executable.
# If commented out or empty, the launcher will attempt to auto-detect Chrome.
chrome_binary: "/opt/google/chrome/chrome"

# Chrome command-line arguments
chrome_argv:
  - "--headless"

# --- Security Settings ---
security:
  # Enable Seccomp Userspace Notification mechanism.
  # This allows the launcher to intercept and make decisions on specific syscalls.
  # Default: true
  seccomp_notify: true

  # Monitor 'open' and 'openat' syscalls via Seccomp.
  # Necessary for enforcing the File Access Rules.
  # Default: true
  open_syscall_monitored: true

  # Enable Ptrace-based sandboxing.
  # If enabled, Seccomp Notification is disabled. Ptrace is more invasive/slower
  # but works on older kernels or where seccomp user notify is unavailable.
  # Default: false
  ptrace_enabled: false

# --- Logging Settings ---
logging:
  # Enable audit logging of allowed/blocked actions.
  # Default: false (unless --record is passed)
  audit_enabled: false

  # Path to the audit log file.
  audit_path: "open_read_log.txt"


# --- Access Rules ---
# These lists define what the Chrome process is allowed to access.
# Entries support "[action],[type],[path]" format.
# - action: "allow" or "deny" (default allow).
# - type: "exact", "prefix", "suffix", "prefix_suffix".
# - path: The file path or pattern.

rules:
  # File Access Rules: Files/Directories Chrome can open for READ/READ-WRITE.
  file:
    # Explicit Exact Rules
    - "allow,exact,/dev/tty"
    - "allow,exact,/dev/urandom"
    - "allow,exact,/dev/null"
    - "allow,exact,/dev/random"

    # Explicit Prefix Rules (Recursive directory access)

    - "allow,prefix,/dev"
    - "allow,prefix,/etc"
    - "allow,prefix,/usr"
    - "allow,prefix,/lib"
    - "allow,prefix,/lib64"
    - "allow,prefix,/proc"
    - "allow,prefix,/sys"
    - "allow,prefix,/tmp"
    - "allow,prefix,/run/user"
    - "allow,prefix,/var/cache/fontconfig"
    - "allow,prefix,/opt/google/chrome"

    # User home directory permissions
    - "allow,prefix,/home"
    - "allow,prefix,/data/home"

    # Example of other types (commented out)
    # - "allow,suffix,.log"
    # - "allow,prefix_suffix,/var/log/*.log"

  # Exec Rules: Programs Chrome is allowed to execute (via execve/execveat).
  exec:
    - "allow,exact,/opt/google/chrome/chrome"
    - "allow,exact,/opt/google/chrome/chrome-sandbox"
    - "allow,exact,/opt/google/chrome/chrome_crashpad_handler"
    - "allow,exact,/usr/bin/cat"
    - "allow,exact,/usr/bin/ls"
    - "allow,exact,/proc/self/exe"
    - "allow,exact,/usr/bin/readlink"
    - "allow,exact,/usr/bin/dirname"

  # Write Rules: Directories where Chrome is explicitly allowed to WRITE.
  write:
    - "allow,prefix,/home"
    - "allow,prefix,/tmp"
    - "allow,prefix,/proc/self"
    - "allow,prefix,/dev/shm"
    - "allow,prefix,/dev/dri"
    - "allow,prefix,/data/home"
    - "allow,prefix,/run/user"
    - "allow,exact,/dev/tty"
    - "allow,exact,/dev/null"

  # Syscall Rules: Fine-grained system call filtering.
  # System calls are default-allow. Add "deny" rules here to harden the sandbox.
  # A few highly dangerous syscalls are blocked by default (e.g., ptrace, mount).
  # You can override this by adding an "allow" rule.
  # Format: "[action],[syscall_name]"
  syscalls:
    # Example: Block network access
    # - "deny,socket"

    # Example: Override a default block
    # - "allow,ptrace"