Skip to content
Security Policies

Security Policies

Security policies define which runtime operations the Sensor permits. In enforce mode, any covered operation without a matching rule is denied.

Policy Modes

ModeBehaviorUse it for
deriveObserve activity and produce rulesCapture an initial baseline
observeRecord violations without blockingTest a refined policy
enforceBlock unauthorized operationsProtect validated workloads and builds

Policies can control file access, execution, IP and Unix networking, containers, process control, kernel operations, memory, IOCTL, and IPC. See the Specification for every operation.

Rule Structure

Rules are strings. Depending on the operation, a rule contains one, two, or three pipe-delimited values:

process_path
process_path|target
process_path|target|qualifier

For example, this rule permits curl to connect to the specified address on port 443:

/usr/bin/curl|192.0.2.10/32|443

Common values include:

ValueMeaning
allMatch any value in that position
{a,b,c}Expand to several alternatives
%workspace%Job workspace path
%home%Calling user’s home directory
%hostname%Sensor host name
%uid%Calling user’s numeric UID
%user%Calling user’s name
<anonymous>Anonymous or memfd-backed execution where supported

The exact number and meaning of values depends on the operation. Do not infer a format from another operation; use the Specification.

Policy Lifecycle

1. Derive

Start with:

{
  "mode": "derive"
}

Run representative builds or workloads, including optional paths and failure handling. Stop the Endura job to emit the derived policy.

Derivation records observed behavior, not intended behavior. It cannot capture a valid branch that did not run, and it can capture one-time setup or unwanted behavior that did run.

2. Refine

Review the derived rules before assigning the policy:

  • remove one-time or unexpected operations;
  • replace dynamic filenames with the narrowest stable parent directory;
  • consolidate equivalent values with brace expansion;
  • broaden individual IP addresses only to verified service ranges; and
  • add legitimate branches that were not exercised during derivation.

For example, consolidate dynamic files:

/usr/bin/bash|/opt/app/tmp/script-1842
/usr/bin/bash|/opt/app/tmp/script-7309

into the stable directory rule:

/usr/bin/bash|/opt/app/tmp

Path arguments use directory-prefix matching, except identity-style fields documented in the specification. A policy with too many unrefined rules can fail to load with Argument list too long (os error 7).

The Sensor derives IP connections as addresses with /32 for IPv4 or /128 for IPv6. Confirm the service’s complete address range before replacing those entries with a broader CIDR.

3. Observe

Change the refined policy to:

{
  "mode": "observe"
}

Run it across representative builds or workloads. Review every violation in Team Server, then update the policy or remove behavior that should not occur.

4. Enforce

After observe-mode runs complete without unexplained violations, set:

{
  "mode": "enforce"
}

The Sensor now blocks unauthorized covered operations. Continue reviewing violations after deployment so changes in tools or infrastructure do not become unexplained failures.

Manage Policies in Team Server

To create a policy:

  1. Open Policies and select Create.
  2. Enter its name, description, and version.
  3. Paste or write the policy.
  4. Select Create.

To assign it:

  1. Open Policies.
  2. Select Assign Policy for the policy.
  3. Choose one or more pipelines.
  4. Select Assign.

Policy owners and Administrators can edit, assign, revert, and delete policies. See Access Control.

Next Steps