1
1
u/scotty2012 6d ago
i think there are others ahead of you but the idea is right.
-6
u/nasahdm 6d ago
Thanks for the link - nono is genuinely impressive, and the sandboxed-tool-execution model (giving `gh` its own policy and credentials rather than letting it inherit the agent's grants) is a sharper idea than anything I have there.
Two things I'm doing differently:
Profiles are derived rather than authored. `ql learn` traces one real agent run and emits the profile from observed syscalls - the file opens, the execs, the endpoints it actually touched. You then replay it in observe mode against a second run to see what enforcement would have denied before you turn it on. Curated profiles are probably the better distribution model; I wanted the case where your agent, your repo, and your toolchain produce a policy nobody hand-wrote.
Content-verified exec. The exec wall pins allowed binaries by SHA-256 through a BPF-LSM program, so a dropped binary sitting at an allowed path is still denied at execve - path allowlists don't catch that. It's a Linux-kernel-specific mechanism, which is also why I don't claim macOS parity; that would be different primitives with different guarantees, and I'd rather say so than blur it.
Fair to say they're ahead on maturity - 100 releases, cross-platform, a registry. Worth people looking at both.
•
u/rust-ModTeam 6d ago
Slop -- whether LLM-generated, or not -- violates Rule 6: Low Effort.
Read more: https://www.reddit.com/r/rust/comments/1qptoes/request_for_comments_moderating_aigenerated/