Security Policies

Security policies define permitted Linux operations. Start by deriving a policy from representative work, test it, then enforce it.

Policy Modes

Mode	Behavior
`derive`	Observe activity and generate rules
`observe`	Report violations without blocking
`enforce`	Deny through LSM hooks and, by default, terminate offending tasks on LSM/fallback paths

ENDURA_SENSOR_KILL_TASK=false disables termination, retaining direct LSM denial. Omitted operations have no permissions; see Policy Defaults.

Policy Lifecycle

1. Derive

Start with an empty policy:

{"mode":"derive"}

Start the job with that file, run representative work, then stop it to save the derived rules. The local walkthrough shows the commands. For CI, use your provider’s cleanup pattern.

Exercise optional paths and failure handling. Derivation captures behavior that ran, including unwanted or one-time activity; it cannot infer untested paths. The Sensor simplifies derived rules without adding unobserved combinations.

2. Refine

Remove unexpected or one-time permissions. Replace dynamic files with the narrowest stable parent directory, consolidate equivalent values with braces, and add legitimate untested paths. Confirm service address ranges before broadening derived /32 or /128 IP rules.

For example, replace /opt/app/tmp/script-1842 and /opt/app/tmp/script-7309 with /opt/app/tmp only when all descendants should be permitted. Unrefined policies can exceed runtime capacity and fail with Argument list too long (os error 7).

3. Observe

Change only mode to observe, keeping the refined rules. Validate the file with endura policy validate, then start a new job using it. For central builds, create and assign the policy first.

Review representative runs in Team Server or local Sensor logs. Resolve every unexplained violation before enforcement.

4. Enforce

Change only mode to enforce, validate, and start a new job. Continue reviewing violations as tools and infrastructure change. Policy changes apply at job start, not to existing jobs.

Rule Structure

Rules use operation-specific pipe-delimited values, for example:

/usr/bin/curl|192.0.2.10/32|443

This permits that program to connect to that address and port. Use all for a wildcard, braces for alternatives, and variables for reusable or job-specific values. Path values generally include descendants; consult the specification for formats and exceptions.

Next Steps

Manage policies · Defaults · Variables · Specification · Examples