Skip to main content

Allow list

Simple Story

Each layer carries a short list of what is permitted, and nothing else gets through.

The important half of that sentence is the second one. The list does not say what is forbidden, because there is no way to write down everything a pupil might try. It says what is allowed, and everything absent from it is refused by default.

What it is

Each layer is driven by a declarative rule set derived from the security policy, and each is fail-closed: anything not listed is denied, and Phobos aborts with PHB-EBASE when no base configuration is present at all.

LayerRule set
BubblewrapThe set of paths bound read-only, bound writable, or hidden behind a tmpfs.
LD-Preload FirewallA table of host, CIDR and port rules consulted on each connection attempt.
TimeoutThe wall-clock budget.

Further reading