nono-py/python/nono_py/__init__.py at f30b32982dd5dffc53cc24456aa9623b70eca526 · nolabs-ai/nono-py · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
"""nono: Capability-based sandboxing for Python.

This module provides OS-enforced sandboxing using Landlock (Linux) and
Seatbelt (macOS). Once a sandbox is applied, unauthorized operations are
structurally impossible.

Example:
    >>> from nono_py import CapabilitySet, AccessMode, apply
    >>> caps = CapabilitySet()
    >>> caps.allow_path("/tmp", AccessMode.READ_WRITE)
    >>> caps.block_network()
    >>> apply(caps)  # Irreversible!

Classes:
    AccessMode: File system access mode (READ, WRITE, READ_WRITE)
    CapabilitySet: Collection of sandbox permissions
    CapabilitySource: Origin of a capability grant
    FsCapability: A filesystem capability grant
    SandboxState: Serializable snapshot of capabilities
    SupportInfo: Platform support information
    QueryContext: Query permissions without applying sandbox

Functions:
    apply(caps): Apply the sandbox (irreversible)
    is_supported(): Check if sandboxing is available
    support_info(): Get platform support details
"""

from nono_py import audit
from nono_py._nono_py import (
    AccessMode,
    AwsAuthConfig,
    CapabilitySet,
    CapabilitySource,
    Change,
    ContentHash,
    ExclusionConfig,
    ExecResult,
    ExternalProxyConfig,
    FileState,
    FsCapability,
    InjectMode,
    Policy,
    ProxyConfig,
    ProxyHandle,
    QueryContext,
    ResolvedPolicy,
    RouteConfig,
    SandboxState,
    SessionMetadata,
    SnapshotManager,
    SnapshotManifest,
    SupportInfo,
    apply,
    apply_unlink_overrides,
    build_session_diagnostic_report,
    embedded_policy_json,
    is_supported,
    load_embedded_policy,
    load_policy,
    merge_diagnostic_report_json,
    sandboxed_exec,
    start_proxy,
    support_info,
    validate_deny_overlaps,
)

__all__ = [
    "AccessMode",
    "audit",
    "CapabilitySet",
    "CapabilitySource",
    "Change",
    "ContentHash",
    "ExclusionConfig",
    "ExecResult",
    "ExternalProxyConfig",
    "FileState",
    "FsCapability",
    "AwsAuthConfig",
    "InjectMode",
    "Policy",
    "ProxyConfig",
    "ProxyHandle",
    "QueryContext",
    "ResolvedPolicy",
    "RouteConfig",
    "SandboxState",
    "SessionMetadata",
    "SnapshotManager",
    "SnapshotManifest",
    "SupportInfo",
    "apply",
    "apply_unlink_overrides",
    "build_session_diagnostic_report",
    "embedded_policy_json",
    "is_supported",
    "load_embedded_policy",
    "load_policy",
    "merge_diagnostic_report_json",
    "sandboxed_exec",
    "start_proxy",
    "support_info",
    "validate_deny_overlaps",
]

__version__ = "0.9.0"