|
|
|
|
|
|
by aka-rider
25 days ago
|
|
|
On MacOS you have a seatbelt sandbox built-in.
On Linux - docker with SELinux or similar utility over namespaces. You need to model attack vector first. `rm -rf` - restricted write `curl malware.sh | sh` restrict execution from writeable dirs (seatbelt/SELinux) Restricted write to sensitive directories would most likely neuter most malware. Credentials leak - cleanup environment, deny reading .ssh, .aws, other, and don't allow LLMs anywhere near production systems. I made a small utility for MacOS https://github.com/aka-rider/leash But it may be as well a bash script |
|
|