Examples

Use these examples to understand policy structure, then derive and refine a policy from your own build or workload. Paths, addresses, binaries, and optional branches differ between environments.

Complete starter policies use observe mode unless the example is specifically about enforcement.

Minimal Policies

Derive a Baseline

{
  "mode": "derive"
}

Run representative work, then capture the policy emitted by endura job stop.

Observe with No Permissions

{
  "mode": "observe"
}

This records violations for every covered operation without blocking them. It is useful for confirming what a narrowly empty policy would deny.

Enforce Deny-all

{
  "mode": "enforce"
}

All covered operations without a matching rule are denied. Use only when that behavior is intentional.

Complete Language-build Example

This Node.js example demonstrates execution, network, JIT memory, process, and broad workspace access. Replace broad all rules with derived paths before enforcement. The temporary-directory rules use /tmp; change them to the directory your workload actually uses.

{
  "mode": "observe",
  "path": {
    "execute": [
      "all|{/bin,/usr/bin}/bash|all",
      "all|{/bin,/usr/bin}/node|all",
      "all|{/bin,/usr/bin}/npm|all",
      "all|all|{/bin,/usr/bin}/{cat,cp,grep,ls,mkdir,mv,rm,sed}"
    ],
    "create": [
      "all|%workspace%",
      "all|/tmp"
    ],
    "delete": [
      "all|%workspace%",
      "all|/tmp"
    ],
    "open": ["all"],
    "write": [
      "all|%workspace%",
      "all|/tmp"
    ]
  },
  "ip": {
    "connect": [
      "all|registry.npmjs.org|443",
      "all|github.com|443"
    ]
  },
  "unix": {
    "connect": ["all"]
  },
  "hook": {
    "wx": ["{/bin,/usr/bin}/node"]
  },
  "task": {
    "kill": ["all"],
    "pgroup": ["all"]
  },
  "ioctl": {
    "cmd": ["all"]
  }
}

Key decisions:

hook.wx permits Node.js JIT memory.
network rules restrict package and source access to expected services;
file mutation is limited to the workspace and /tmp; and
path.open remains broad because build tools read system libraries and configuration. Refine it from observed paths.

Toolchain Deltas

The following are rule additions, not complete policies. Merge only the values your derived policy needs.

Toolchain	`path.execute` values	Common `ip.connect` targets	Other operation
Python	`all	{/usr/bin,/usr/local/bin}/{python,python3,pip,pip3,pytest}	all`
Go	`all	/usr/local/go/bin/{go,gofmt,compile,link,asm}	all`
Java/Maven	`all	{/usr/bin,/usr/local/bin}/{java,mvn}	all`
Rust/Cargo	`all	{/usr/bin,/usr/local/bin}/{cargo,rustc}	all`

An IP rule has the complete form process|address|port, for example:

all|pypi.org|443

Derivation usually records concrete /32 or /128 addresses. Verify service ranges before broadening them.

Complete Container-build Example

This example permits Docker to run selected images and access its daemon socket:

{
  "mode": "observe",
  "container": {
    "run": [
      "docker.io/library/node|all",
      "gcr.io/example/application|all"
    ]
  },
  "path": {
    "execute": [
      "all|{/bin,/usr/bin}/bash|all",
      "all|/usr/bin/docker|all",
      "all|all|{/bin,/usr/bin}/{cat,cp,ls,mkdir,mv,rm}"
    ],
    "create": ["all"],
    "delete": ["all"],
    "open": ["all"],
    "write": ["all"],
    "pivot": [
      "/usr/bin/runc|all|all"
    ]
  },
  "ip": {
    "connect": [
      "all|registry-1.docker.io|443",
      "all|auth.docker.io|443",
      "all|gcr.io|443"
    ]
  },
  "unix": {
    "connect": [
      "all|/var/run/docker.sock"
    ]
  },
  "netlink": {
    "bind": ["all"]
  },
  "task": {
    "kill": ["all"],
    "pgroup": ["all"]
  },
  "ioctl": {
    "cmd": ["all"]
  }
}

Docker daemon access is equivalent to host-level control. Permit it only for builds that require it, then refine the broad file and IOCTL rules from derivation.

Infrastructure-tool Deltas

Tool	Execution value	Typical network requirement
Kubernetes	`all	{/usr/bin,/usr/local/bin}/{kubectl,helm}
Terraform	`all	{/usr/bin,/usr/local/bin}/terraform
Security scanners	`all	{/usr/bin,/usr/local/bin}/{grype,semgrep,snyk,trivy}
Database migration	`all	{/usr/bin,/usr/local/bin}/{flyway,mysql,psql}

Prefer exact service CIDRs over blanket private-network rules.

Restrictive Production-build Example

This example demonstrates a deliberately narrow, network-isolated compiler policy. Adapt it to actual derived behavior before use.

{
  "mode": "enforce",
  "path": {
    "execute": [
      "all|/bin/bash|%workspace%/build.sh",
      "all|/usr/bin/make|%workspace%/Makefile",
      "/bin/bash|/usr/bin/gcc|%workspace%/src/main.c",
      "/bin/bash|/usr/bin/g++|%workspace%/src/main.cpp",
      "all|all|{/bin,/usr/bin}/{cat,cp,ls,mkdir,mv,rm}"
    ],
    "create": [
      "{/bin,/usr/bin}/{mkdir,touch}|%workspace%",
      "/usr/bin/{gcc,g++,make}|%workspace%/build"
    ],
    "delete": [
      "{/bin,/usr/bin}/rm|%workspace%/build",
      "/usr/bin/make|%workspace%/build"
    ],
    "open": [
      "{/bin,/usr/bin}/{bash,cat}|%workspace%",
      "/usr/bin/{gcc,g++,make}|%workspace%",
      "/usr/bin/{gcc,g++}|{/usr/include,/usr/lib}"
    ],
    "write": [
      "/usr/bin/{gcc,g++}|%workspace%/build",
      "/usr/bin/make|%workspace%/build"
    ]
  },
  "ip": {
    "connect": []
  },
  "unix": {
    "connect": [
      "all|/run/endura/sensor.sock"
    ]
  },
  "task": {
    "kill": [
      "/bin/bash|/bin/bash",
      "/usr/bin/make|all"
    ],
    "pgroup": [
      "/bin/bash|/bin/bash"
    ]
  },
  "ioctl": {
    "cmd": [
      "all|/dev/tty|all",
      "all|/dev/null|all"
    ]
  }
}

Granular Operation Examples

File Mutation

{
  "mode": "observe",
  "path": {
    "create": [
      "/usr/bin/npm|%workspace%/node_modules"
    ],
    "delete": [
      "/usr/bin/npm|%workspace%/node_modules"
    ],
    "rename": [
      "/bin/mv|%workspace%|%workspace%"
    ],
    "symlink": [
      "/usr/bin/ln|%workspace%"
    ],
    "write": [
      "/usr/bin/node|%workspace%/build"
    ]
  }
}

Kernel Modules

{
  "mode": "observe",
  "kernel": {
    "module": [
      "/sbin/modprobe|overlay",
      "/usr/bin/runc|overlay"
    ]
  }
}

Container Socket Exposure

{
  "mode": "observe",
  "container": {
    "socket": [
      "docker.io/docker|27",
      "gcr.io/kaniko-project/executor|all"
    ]
  }
}

Socket-backed Standard Streams

socket.stdio evaluates only AF_INET and AF_INET6 socket-backed standard streams. Permit the executing and executed program pair:

{
  "mode": "observe",
  "socket": {
    "stdio": [
      "/usr/sbin/xinetd|/usr/sbin/in.telnetd"
    ]
  }
}

Unix domain socket-backed standard streams are not evaluated by this operation.

Refinement Patterns

Consolidate Values with Braces

Before:

/usr/bin/curl|api.example.com|80
/usr/bin/curl|api.example.com|443
/usr/bin/curl|api.example.com|8080

After:

/usr/bin/curl|api.example.com|{80,443,8080}

Consolidate Dynamic Paths

Before:

/bin/bash|%workspace%/scripts/build.sh
/bin/bash|%workspace%/scripts/test.sh
/bin/bash|%workspace%/scripts/deploy.sh

After:

/bin/bash|%workspace%/scripts/{build,test,deploy}.sh

Use Verified CIDRs

Before:

all|192.168.1.1/32|443
all|192.168.1.2/32|443
all|192.168.1.3/32|443

After confirming that the entire subnet belongs to the service:

all|192.168.1.0/24|443

Escaping Paths

Whitespace inside a value is significant:

{
  "mode": "observe",
  "path": {
    "open": [
      "all|%workspace%/My Project/build"
    ]
  }
}

The characters \, {, }, ,, %, and | are structural. Escape a literal structural character with a backslash. JSON also escapes backslashes, so one literal backslash in a path requires four in policy JSON:

{
  "mode": "observe",
  "path": {
    "open": [
      "all|/srv/back\\\\slash",
      "all|/srv/report\\,2024.csv",
      "all|/srv/100\\%"
    ]
  }
}

These values name /srv/back\slash, /srv/report,2024.csv, and /srv/100%.

Empty components such as all| and all||443 are invalid rather than wildcards.

Specification