bumblewrap/whitelist.txt at main · juneguo257/bumblewrap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
# Bumblewrap Sandbox — Whitelist Configuration
#
# Each non-blank, non-comment line is an allowed path.
#
#   - Paths ending with '/' are directory prefixes: any absolute path
#     underneath them is permitted (e.g. /usr/lib/ allows /usr/lib/libc.so).
#
#   - Paths without a trailing '/' are exact-match entries.
#
# Only absolute paths (starting with /) are subject to the whitelist.
# Relative paths passed to openat() are allowed through unconditionally.
#
# To test the sandbox, try accessing a path NOT listed here, e.g.:
#     cat /root/.bashrc          # should fail with "Permission denied"
#     ls /opt/                   # should fail
#     cat /home/user/secret.txt  # should fail

/opt/bumblewrap/

# ── Core system binaries ──
/bin/
/sbin/
/usr/bin/
/usr/sbin/

# ── Shared libraries ──
/lib/
/lib64/
/usr/lib/
/usr/lib64/

# ── System configuration ──
/etc/

# ── Device nodes ──
/dev/

# ── Virtual filesystems ──
/proc/
/sys/

# ── Runtime state ──
/run/

# ── Temporary files ──
/tmp/

# ── Variable data (logs, caches, package state) ──
/var/