Security Policies
Examples

Examples

This page provides example security policies for common CI/CD scenarios. Use these as starting points and customize them for your specific pipeline requirements.

Minimal Policies

Deny All (Default)

The most restrictive policy. When in enforce mode, all operations not explicitly permitted are denied. Use as a starting point to incrementally add only required permissions.

{
    "mode": "observe"
}

Derive Mode

Use derive mode to automatically generate a policy based on observed runtime behavior. Run your pipeline with this policy, then extract the derived policy from the build output.

{
    "mode": "derive"
}

Permit All

Allows all operations without restrictions. Useful for baseline testing or development environments where security enforcement is not required.

Not for Production: This policy permits all operations and provides no security value. Use only for testing or development purposes.
{
    "mode": "observe",
    "container": {
        "run": ["all"],
        "socket": ["all"]
    },
    "hook": {
        "ptrace": ["all"],
        "mem": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    },
    "ip": {
        "bind": ["all"],
        "connect": ["all"]
    },
    "kernel": {
        "ebpf": ["all"],
        "module": ["all"],
        "read": ["all"]
    },
    "mmap": {
        "file": ["all"]
    },
    "mprotect": {
        "wx": ["all"]
    },
    "netlink": {
        "bind": ["all"]
    },
    "socket": {
        "packet": ["all"],
        "raw": ["all"],
        "inject": ["all"],
        "sniff": ["all"]
    },
    "path": {
        "create": ["all"],
        "delete": ["all"],
        "execute": ["all"],
        "open": ["all"],
        "write": ["all"],
        "quota": ["all"],
        "pivot": ["all"],
        "chroot": ["all"]
    },
    "privilege": {
        "escalate": ["all"]
    },
    "sysv": {
        "shmem": ["all"],
        "msgqueue": ["all"]
    },
    "task": {
        "kill": ["all"],
        "rlimit": ["all"],
        "schedule": ["all"],
        "nice": ["all"],
        "pgroup": ["all"]
    },
    "unix": {
        "bind": ["all"],
        "connect": ["all"]
    },
    "vsock": {
        "bind": ["all"],
        "connect": ["all"]
    }
}

Node.js Application Build

A policy for building and testing a typical Node.js application with npm.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|{/bin,/usr/bin}/node|all",
            "all|{/bin,/usr/bin}/npm|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv,grep,sed,awk}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|registry.npmjs.org|443",
            "all|www.npmjs.com|443",
            "all|github.com|443",
            "all|api.github.com|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "mprotect": {
        "wx": [
            "{/bin,/usr/bin}/node"
        ]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Key policy decisions:

  • Execution: Allows bash, node, and npm to run workspace scripts and standard binaries
  • Network: Restricts outbound connections to npm registry and GitHub
  • Memory: Permits W+X memory for Node.js JIT compilation
  • Process management: Allows process termination and grouping for npm scripts

Python Application Build

A policy for building Python applications with pip and pytest.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|{/bin,/usr/bin,/usr/local/bin}/{python,python3,python3.11,python3.12}|all",
            "all|{/bin,/usr/bin,/usr/local/bin}/{pip,pip3}|all",
            "all|{/bin,/usr/bin,/usr/local/bin}/pytest|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv,grep,sed,awk}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|pypi.org|443",
            "all|files.pythonhosted.org|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "mprotect": {
        "wx": [
            "{/bin,/usr/bin,/usr/local/bin}/{python,python3,python3.11,python3.12}"
        ]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Go Application Build

A policy for building Go applications.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|/usr/local/go/bin/go|all",
            "all|all|/usr/local/go/bin/{go,gofmt,compile,link,asm}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|proxy.golang.org|443",
            "all|sum.golang.org|443",
            "all|github.com|443",
            "all|storage.googleapis.com|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Key policy decisions:

  • Network: Restricts to Go module proxy, checksum database, and GitHub
  • No W+X: Go binaries are statically compiled and do not require JIT

Java/Maven Build

A policy for building Java applications with Maven.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|{/bin,/usr/bin}/java|all",
            "all|{/bin,/usr/bin}/mvn|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|repo.maven.apache.org|443",
            "all|repo1.maven.org|443",
            "all|central.sonatype.com|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "mprotect": {
        "wx": [
            "{/bin,/usr/bin}/java"
        ]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Rust/Cargo Build

A policy for building Rust applications with Cargo.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|{/usr/bin,/usr/local/bin}/cargo|all",
            "all|{/usr/bin,/usr/local/bin}/rustc|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|crates.io|443",
            "all|static.crates.io|443",
            "all|static.rust-lang.org|443",
            "all|github.com|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Docker Build Pipeline

A policy for pipelines that build and push Docker images.

{
    "mode": "observe",
    "container": {
        "run": [
            "docker.io/library/node|all",
            "gcr.io/myproject/myapp|all"
        ]
    },
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|/usr/bin/docker|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"],
        "pivot": [
            "/usr/bin/runc|all|all"
        ]
    },
    "ip": {
        "connect": [
            "all|registry-1.docker.io|443",
            "all|auth.docker.io|443",
            "all|gcr.io|443"
        ]
    },
    "unix": {
        "connect": [
            "all|/var/run/docker.sock"
        ]
    },
    "netlink": {
        "bind": ["all"]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Key policy decisions:

  • Container images: Restricts to Docker Hub and Google Container Registry
  • Docker socket: Allows access to the Docker daemon socket
  • pivot_root: Required for container runtime operations
  • Network: Restricted to container registries

Kubernetes Deployment Pipeline

A policy for pipelines that deploy to Kubernetes clusters.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|{/usr/bin,/usr/local/bin}/kubectl|all",
            "all|{/usr/bin,/usr/local/bin}/helm|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|eks.amazonaws.com|443",
            "all|azmk8s.io|443",
            "all|container.googleapis.com|443",
            "all|kubernetes.default.svc|443",
            "all|10.0.0.0/8|443",
            "all|172.16.0.0/12|443",
            "all|192.168.0.0/16|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Key policy decisions:

  • Tools: Allows kubectl and helm execution
  • Network: Permits connections to common cloud Kubernetes endpoints and private network ranges

Terraform Infrastructure Pipeline

A policy for infrastructure-as-code pipelines using Terraform.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|{/usr/bin,/usr/local/bin}/terraform|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|releases.hashicorp.com|443",
            "all|registry.terraform.io|443",
            "all|sts.amazonaws.com|443",
            "all|management.azure.com|443",
            "all|storage.googleapis.com|443",
            "all|login.microsoftonline.com|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Security Scanning Pipeline

A policy for pipelines that run security scanning tools.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|/usr/bin/trivy|all",
            "all|/usr/bin/grype|all",
            "all|/usr/bin/semgrep|all",
            "all|/usr/bin/snyk|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|ghcr.io|443",
            "all|api.snyk.io|443",
            "all|semgrep.dev|443",
            "all|toolbox.anchore.io|443",
            "all|github.com|443"
        ]
    },
    "unix": {
        "connect": ["all"]
    },
    "mprotect": {
        "wx": [
            "{/bin,/usr/bin}/{python,python3,python3.11,python3.12}",
            "{/bin,/usr/bin}/node"
        ]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Database Migration Pipeline

A policy for pipelines that run database migrations.

{
    "mode": "observe",
    "path": {
        "execute": [
            "all|{/bin,/usr/bin}/bash|all",
            "all|/usr/bin/psql|all",
            "all|/usr/bin/mysql|all",
            "all|{/usr/bin,/usr/local/bin}/flyway|all",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,rm,mv}"
        ],
        "create": ["all"],
        "delete": ["all"],
        "open": ["all"],
        "write": ["all"]
    },
    "ip": {
        "connect": [
            "all|10.0.0.0/8|{5432,3306}",
            "all|172.16.0.0/12|{5432,3306}",
            "all|192.168.0.0/16|{5432,3306}",
            "all|mydb.cluster-xyz.us-east-1.rds.amazonaws.com|{5432,3306}",
            "all|mydb.postgres.database.azure.com|{5432,3306}",
            "all|myproject:us-central1:myinstance|{5432,3306}"
        ]
    },
    "unix": {
        "connect": [
            "all|/var/run/postgresql/.s.PGSQL.5432",
            "all|/var/run/mysqld/mysqld.sock"
        ]
    },
    "task": {
        "kill": ["all"],
        "pgroup": ["all"]
    },
    "ioctl": {
        "cmd": ["all"]
    }
}

Key policy decisions:

  • Database tools: Allows psql, mysql, and Flyway
  • Network: Restricts to private networks and cloud database endpoints on standard ports
  • Unix sockets: Permits connections to local database sockets

High-Security Production Build

A maximally restrictive policy for sensitive production builds. This example demonstrates granular control over file system operations.

{
    "mode": "enforce",
    "path": {
        "execute": [
            "all|/bin/bash|%workspace%/build.sh",
            "all|/usr/bin/make|%workspace%/Makefile",
            "/bin/bash|/usr/bin/gcc|%workspace%/src/main.c",
            "/bin/bash|/usr/bin/g++|%workspace%/src/main.cpp",
            "all|all|{/bin,/usr/bin}/{ls,cat,mkdir,cp,mv,rm}"
        ],
        "create": [
            "{/bin,/usr/bin}/{mkdir,touch}|%workspace%",
            "/usr/bin/{gcc,g++,make}|%workspace%/build"
        ],
        "delete": [
            "{/bin,/usr/bin}/rm|%workspace%/build",
            "/usr/bin/make|%workspace%/build"
        ],
        "open": [
            "{/bin,/usr/bin}/{bash,cat}|%workspace%",
            "/usr/bin/{gcc,g++,make}|%workspace%",
            "/usr/bin/{gcc,g++}|{/usr/include,/usr/lib}"
        ],
        "write": [
            "/usr/bin/{gcc,g++}|%workspace%/build",
            "/usr/bin/make|%workspace%/build"
        ]
    },
    "ip": {
        "connect": []
    },
    "unix": {
        "connect": [
            "all|/var/run/endura/sensor.sock"
        ]
    },
    "task": {
        "kill": [
            "/bin/bash|/bin/bash",
            "/usr/bin/make|all"
        ],
        "pgroup": [
            "/bin/bash|/bin/bash"
        ]
    },
    "ioctl": {
        "cmd": [
            "all|/dev/tty|all",
            "all|/dev/null|all"
        ]
    }
}

Key policy decisions:

  • Mode: Set to enforce for active blocking
  • Execution: Limited to specific build scripts and compilers
  • File creation/deletion: Only build tools can modify the workspace build directory
  • File reads: Compilers can only read source files and system headers
  • File writes: Only compilers and make can write to the build output directory
  • Network: No outbound connections permitted (air-gapped build)
  • Process control: Highly restricted kill and pgroup operations

Granular File System Policies

The path.create, path.delete, path.open, and path.write operations support granular process_path|target_path rules. This allows you to restrict which processes can perform file operations and where.

Transitioning from all to Specific Rules

Permissive (starter policy):

"path": {
    "create": ["all"],
    "delete": ["all"],
    "open": ["all"],
    "write": ["all"]
}

Restrictive (production policy):

"path": {
    "create": [
        "{/bin,/usr/bin}/{mkdir,touch}|%workspace%",
        "/usr/bin/npm|%workspace%/node_modules"
    ],
    "delete": [
        "{/bin,/usr/bin}/rm|%workspace%",
        "/usr/bin/npm|%workspace%/node_modules"
    ],
    "open": [
        "all|%workspace%",
        "all|{/usr/lib,/lib,/etc}",
        "/usr/bin/node|/usr/share/nodejs"
    ],
    "write": [
        "/usr/bin/npm|%workspace%/node_modules",
        "/usr/bin/node|%workspace%/build",
        "all|/tmp"
    ]
}

Kernel Module Restrictions

For workloads that require kernel module loading, you can restrict which modules are allowed:

"kernel": {
    "module": [
        "/sbin/modprobe|overlay",
        "/usr/bin/runc|overlay",
        "/usr/sbin/ip|{dummy,veth}"
    ]
}

Container Socket Access

Restrict which container images can access the Docker/Podman socket:

"container": {
    "socket": [
        "docker.io/docker|24",
        "gcr.io/kaniko-project/executor|all"
    ]
}

Policy Refinement Tips

After deriving an initial policy, apply these refinement techniques:

Consolidate Port Lists

Before:

"ip": {
    "connect": [
        "/usr/bin/curl|api.example.com|80",
        "/usr/bin/curl|api.example.com|443",
        "/usr/bin/curl|api.example.com|8080"
    ]
}

After:

"ip": {
    "connect": [
        "/usr/bin/curl|api.example.com|{80,443,8080}"
    ]
}

Combine Similar Scripts

Before:

"path": {
    "execute": [
        "all|/bin/bash|%workspace%/scripts/build.sh",
        "all|/bin/bash|%workspace%/scripts/test.sh",
        "all|/bin/bash|%workspace%/scripts/deploy.sh"
    ]
}

After:

"path": {
    "execute": [
        "all|/bin/bash|%workspace%/scripts/{build,test,deploy}.sh"
    ]
}

Combine Binary Locations

Before:

"path": {
    "execute": [
        "all|/bin/node|all",
        "all|/usr/bin/node|all",
        "all|/usr/local/bin/node|all"
    ]
}

After:

"path": {
    "execute": [
        "all|{/bin,/usr/bin,/usr/local/bin}/node|all"
    ]
}

Use CIDR for IP Ranges

Before:

"ip": {
    "connect": [
        "all|192.168.1.1|443",
        "all|192.168.1.2|443",
        "all|192.168.1.3|443"
    ]
}

After:

"ip": {
    "connect": [
        "all|192.168.1.0/24|443"
    ]
}
Specification