AsrtBashExecutorOptions
Defined in: bash/asrt-executor.ts:16
Properties
Section titled “Properties”allowedDomains?
Section titled “allowedDomains?”
optionalallowedDomains?:string[]
Defined in: bash/asrt-executor.ts:45
Domains allowed for network access. Omit/empty (the default) means no network access.
allowRead?
Section titled “allowRead?”
optionalallowRead?:string[]
Defined in: bash/asrt-executor.ts:42
Confine reads to these paths. Omitted — the default — leaves reads unbounded, which is ASRT’s own default (“read access is allowed everywhere”).
ASRT expresses this as deny-then-allow, where allowRead re-allows within a denied
region and takes precedence over denyRead (the opposite of write). This executor
supplies the broad denial for you — denyRead: ["/"] — so the option means the same
thing here as on createNativeBashExecutor: reads are confined to these roots, rather
than being a modifier whose effect depends on a denyRead the caller had to think to
write. Any denyRead you pass is still applied on top, and stays denied even inside an
allowed root when it is the more specific path.
existingSystemReadPaths() and ASRT’s own package directory are re-allowed
automatically: without the former nothing can execute, and without the latter ASRT’s
vendored apply-seccomp helper is hidden from the sandbox it is setting up (verified —
the command dies with exit 127 before it starts).
allowWrite
Section titled “allowWrite”allowWrite:
string[]
Defined in: bash/asrt-executor.ts:22
Paths writable inside the sandbox — e.g. the tool’s configured project root. Required,
matching the no-unsandboxed-default rule: pass [] for a
sandbox that can run commands but write nowhere, not an implicit “everything.”
deniedDomains?
Section titled “deniedDomains?”
optionaldeniedDomains?:string[]
Defined in: bash/asrt-executor.ts:46
denyRead?
Section titled “denyRead?”
optionaldenyRead?:string[]
Defined in: bash/asrt-executor.ts:24
Paths to deny read, on top of whatever ASRT denies by default (e.g. ~/.ssh).
denyWrite?
Section titled “denyWrite?”
optionaldenyWrite?:string[]
Defined in: bash/asrt-executor.ts:43
maxOutputBytes?
Section titled “maxOutputBytes?”
optionalmaxOutputBytes?:number
Defined in: bash/asrt-executor.ts:48
Bytes to keep from stdout/stderr each before truncating. Default 1,000,000 (1 MB).