Policy Cookbook
The reference tells you what each section means. This tells you what to write.
Every recipe has the same four parts: the situation, the fragment that solves it, what it still forbids, and the version that looks right and is not.
Each recipe is a fragment. Paste it into a task configuration, which is applied on top of the
base policy for the runtime environment, and name that file with --config.
${PHOBOS_HOME}/phobos.sh --config exercise.cfg -- <your command>
| Recipe | The situation |
|---|---|
| Reading a data tree | the command reads a directory of input and changes nothing |
| Running a program tree | the command runs a tool that is not in the base policy |
| Writing an output file | the command produces one file in one place |
| Allowing exactly one host | the command fetches from one host and no other |
| Exposing a listener | the command serves something that has to be reachable |
| Setting time and memory budgets | the run has to end, whatever the command does |
| Importing an Ares 2 policy | the exercise already carries its policy for Ares 2 |
Two habits are worth carrying through all seven.
Check both directions. A test that shows the permitted case working proves nothing about containment, and a test that shows the forbidden case refused proves nothing about usability. Run the command with the fragment and confirm that it succeeds, then take one line out and confirm that it fails.
Read the effective policy before you trust it. --debug prints the whole policy each layer
was given, including the rights that hold after the union. A fragment that reads
narrower than it is shows up there.