Безопасность

"sandbox": {
    "allowUnsandboxedCommands": false,
    "autoAllowBashIfSandboxed": false,
    "enabled": true,
    "excludedCommands": [
      "git",
      "docker",
      "docker-compose"
    ],
    "filesystem": {
      "allowWrite": [
        "//tmp",
        "~/.cache"
      ],
      "denyRead": [
        "~/.ssh/id_*",
        "~/.aws/credentials"
      ]
    }
  },

#!/bin/bash
# GPU-aware bwrap wrapper for Claude Code sandbox.
#
# Claude Code's sandbox uses bubblewrap but doesn't pass through GPU devices.
# This wrapper injects --dev-bind-try flags for GPU access.
#
# CRITICAL: Device binds must come AFTER --dev /dev to avoid being shadowed
# by the fresh devtmpfs mount. This wrapper parses args and injects at the
# correct position.
#
# Devices passed through:
#   /dev/dri/*     - DRM/Vulkan/OpenGL (all GPUs)
#   /dev/kfd       - AMD ROCm/HIP kernel driver
#   /dev/nvidia*   - NVIDIA CUDA driver
#
# --dev-bind-try gracefully skips missing devices (no error on non-GPU systems).
#
# See: https://github.com/anthropics/claude-code/issues/13108

set -euo pipefail

REAL_BWRAP=/usr/bin/bwrap

# GPU devices to pass through.
GPU_DEVICES=(
    /dev/dri
    /dev/kfd
    /dev/nvidia0
    /dev/nvidiactl
    /dev/nvidia-uvm
    /dev/nvidia-uvm-tools
    /dev/nvidia-modeset
)

# Build new argument list, inserting GPU binds after --dev.
args=()
inject_next=false

for arg in "$@"; do
    [[ "$arg" == "--unshare-net" ]] && continue
    args+=("$arg")

    if [[ "$inject_next" == true ]]; then
        # Just saw --dev and now its DEST arg; inject GPU devices after.
        for dev in "${GPU_DEVICES[@]}"; do
            args+=(--dev-bind-try "$dev" "$dev")
        done
        inject_next=false
    fi

    if [[ "$arg" == "--dev" ]]; then
        inject_next=true
    fi
done

exec "$REAL_BWRAP" "${args[@]}"

"permissions": {
  "deny": [
    "Read(./.env)",
    "Read(~/.ssh/**)",
    "Read(~/.aws/**)",
    "Read(~/.kube/**)",
    "Read(~/.docker/**)",
    "Read(~/.config/gh/**)"
  ]
}

set -a && source .env && set +a && claude

"hooks": {
  "PreToolUse": [
    {
      "matcher": "Read|Edit|Write|MultiEdit|Grep|Glob|Bash",
      "hooks": [
        {
          "type": "command",
          "command": "python3 /path/to/block-secrets-access.py"
        }
      ]
    }
  ]
}

#!/usr/bin/python3
"""PreToolUse hook: blocks file and Bash access that may expose secrets."""
import sys
import json
import re
from pathlib import Path

# ── Sensitive file definitions (for file-tool path checks) ──
SENSITIVE_NAMES = {
    '.env', '.env.local', '.env.production', '.env.development', '.env.staging',
    'credentials.json', 'service-account.json', 'google-credentials.json',
    '.pgpass', 'clearml.conf',
}
SENSITIVE_EXTENSIONS = {'.pem', '.key', '.p12', '.pfx', '.jks'}
SENSITIVE_DIRS = {'secrets', '.ssh', '.aws', '.kube', '.docker'}

# ── Bash: regex fragments ──
_SENS_FILES = '|'.join([
    r'\.env(?:\.\w+)*\b',
    r'credentials\.json',
    r'service-account\.json',
    r'google-credentials\.json',
    r'\.pgpass\b',
    r'clearml\.conf\b',
    r'\S+\.(?:pem|p12|pfx|jks)\b',
    r'\.ssh/',
    r'\.aws/',
    r'\.kube/',
    r'\.docker/',
    r'/secrets/',
    r'config/gh/',
])

_FILE_CMDS = '|'.join([
    'cat', 'head', 'tail', 'less', 'more', 'tac',
    'strings', 'xxd', 'base64', 'od', 'hexdump',
    'source', 'awk', 'sed', 'perl', 'ruby',
    'cp', 'mv', 'ln', 'rsync', 'scp',
    'dd', 'openssl', 'gpg', 'curl',
    r'python3?(?:\.\d+)?', 'node',
])

BASH_RULES: list[tuple[re.Pattern, str]] = [
    (re.compile(rf'\b(?:{_FILE_CMDS})\b.*(?:{_SENS_FILES})'),
     "command operates on sensitive file"),
    (re.compile(rf'\b(?:{_FILE_CMDS})\b.*/\S+\.key\b'),
     "command operates on key file"),
    (re.compile(
        r'\bprintenv\b'
        r'|(?:^|[|;&])\s*env\s*(?:$|\||>|;)'
        r'|\bset\b\s*(?:$|\||>)'
        r'|\bexport\s+-p\b'
    ), "command dumps environment variables"),
    (re.compile(
        r'\b(?:echo|printf)\b.*'
        r'\$\{?\w*(?:SECRET|_KEY|TOKEN|PASSWORD|PASSW|CRED|AUTH|PRIVATE)\w*\}?',
        re.IGNORECASE,
    ), "command prints secret variables"),
    (re.compile(rf'\bgit\s+(?:show|log\s+-p|diff)\b.*(?:{_SENS_FILES})'),
     "git command exposes sensitive file contents"),
    (re.compile(rf'(?:\$\(|`|eval\s).*(?:{_SENS_FILES})'),
     "subshell/eval references sensitive file"),
    (re.compile(r'(?:^|[;&|])\s*\.\s+\S*\.env\b'),
     "dot-sourcing env file"),
]


def is_sensitive_path(file_path_str: str) -> str | None:
    """Returns block reason if path is sensitive, None otherwise."""
    p = Path(file_path_str)
    if p.name in SENSITIVE_NAMES:
        return f"'{p.name}' likely contains secrets"
    if p.suffix.lower() in SENSITIVE_EXTENSIONS:
        return f"'{p.name}' is a key/cert file"
    if any(d in p.parts for d in SENSITIVE_DIRS):
        return f"path goes through sensitive directory"
    if p.name.startswith('.env') and p.name != '.envrc':
        return f"'{p.name}' is an env file"
    return None


def is_sensitive_glob(pattern: str) -> str | None:
    """Returns block reason if glob/pattern targets sensitive files."""
    for name in SENSITIVE_NAMES:
        if name in pattern:
            return f"targets '{name}'"
    for ext in SENSITIVE_EXTENSIONS:
        if f'*{ext}' in pattern or pattern.endswith(ext):
            return f"targets '{ext}' files"
    for d in SENSITIVE_DIRS:
        if d in pattern:
            return f"targets '{d}' directory"
    return None


def check_bash(cmd: str) -> str | None:
    """Returns block reason if command may leak secrets, None otherwise."""
    for rx, reason in BASH_RULES:
        if rx.search(cmd):
            return reason
    return None


def main():
    try:
        data = json.load(sys.stdin)
    except (json.JSONDecodeError, EOFError):
        sys.exit(0)

    inp = data.get('tool_input', {})
    tool = data.get('tool_name', '')

    fpath = inp.get('file_path') or ''
    if fpath:
        reason = is_sensitive_path(fpath)
        if reason:
            print(f"BLOCKED: {reason}", file=sys.stderr)
            sys.exit(2)

    path = inp.get('path', '')
    if path:
        reason = is_sensitive_path(path)
        if reason:
            print(f"BLOCKED: {reason}", file=sys.stderr)
            sys.exit(2)

    if tool == 'Grep':
        g = inp.get('glob', '')
        if g:
            reason = is_sensitive_glob(g)
            if reason:
                print(f"BLOCKED: grep glob {reason}", file=sys.stderr)
                sys.exit(2)

    if tool == 'Glob':
        pat = inp.get('pattern', '')
        if pat:
            reason = is_sensitive_glob(pat)
            if reason:
                print(f"BLOCKED: glob pattern {reason}", file=sys.stderr)
                sys.exit(2)

    cmd = inp.get('command', '')
    if cmd:
        reason = check_bash(cmd)
        if reason:
            print(f"BLOCKED: {reason}", file=sys.stderr)
            sys.exit(2)

    sys.exit(0)


if __name__ == "__main__":
    main()