dcg System 防护包全解拦截磁盘、权限与系统服务类破坏性命令【免费下载链接】destructive_command_guardThe Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents.项目地址: https://gitcode.com/GitHub_Trending/de/destructive_command_guard本指南以 Destructive Command Guarddcg的system类别防护包为对象系统讲解system.disk、system.permissions、system.services三个内置 pack 的防护范围、关键词触发机制、安全放行模式与高危拦截模式并结合仓库源码说明其严重级别、可执行文件作用域等底层实现。读完本文你将掌握如何在config.toml中启用/禁用 system 类防护、如何精确 allowlist 单个规则以及当 Agent 误触磁盘、权限与服务类命令时 dcg 如何分层裁决与给出可操作的安全替代建议。System 类别三个内置包与 Pack 机制system是 dcg 包体系中的一个类别category由 src/packs/system/mod.rs 聚合导出三个子包Pack ID 分别是system.disk、system.permissions、system.services。按 docs/packs/README.md 中的类别表该类别共 3 个 pack其功能定位如下Pack ID名称防护目标system.diskDisk Operationsdd 写设备、mkfs 格式化、分区表修改、RAID 管理、btrfs/LVM/device-mapper 操作、网络块设备、macOS diskutil 擦除/分区/APFS 删除system.permissionsPermissionschmod 777、对系统目录的递归 chmod/chown、setuid/setgid、递归 setfaclsystem.servicesServices停止关键服务、修改 init 配置、关机/重启等电源操作dcg 的 pack 采用两层层级组织类别如system→ 子包如system.disk。启用一个类别即启用其全部子包子包也可在类别启用时被单独禁用。每个 pack 由三部分构成见 src/packs/mod.rs 中Pack结构体keywords关键词用于快速拒绝过滤、safe_patterns安全模式白名单优先匹配、destructive_patterns危险模式黑名单白名单未命中时才检查。启用 system 类别只需在配置中写入[packs] enabled [system]如需单独控制某个子包[packs] enabled [system] disabled [system.permissions] # 保持类别启用但剔除某个子包注意从源码与端到端测试scripts/e2e_destructive_equivalents.sh 中标注system.diskdefault-on可以看出system.disk是默认启用的防护之一完整默认行为请以dcg packs命令输出为准。除[packs]配置外还可用环境变量DCG_PACKSsystem.disk,system.services与DCG_DISABLEsystem.permissions做等价覆盖见 docs/configuration.md。system.disk磁盘操作防护Pack IDsystem.disk该包拦截一切会覆写或抹除磁盘数据的操作从dd直写块设备到分区表修改fdisk/parted、文件系统格式化mkfs/mkswap/wipefs、RAID 管理mdadm、btrfs 子卷与设备操作、device-mapperdmsetup、网络块设备nbd-client、LVM 破坏性命令pvremove/vgremove/lvremove 等以及 macOS 上diskutil的 erase/partition/APFS 删除类操作。关键词Keywords命令文本中只要包含以下任一关键词即进入本包的规则匹配阶段不包含任何关键词的命令会先被快速拒绝跳过本包对应源码 src/packs/system/disk.rs 中的keywords数组dd、diskutil、fdisk、mkfs、mkswap、parted、mount、wipefs、/dev/、mdadm、btrfs、dmsetup、nbd-client、pvremove、vgremove、lvremove、vgreduce、lvreduce、lvresize、pvmove关键词的意义在于防止假阴性单元测试wipefs_is_reachable_via_keywords明确断言wipefs --all somefile.img必须能通过关键词到达本包并被wipefs规则拦截否则该命令会被提前过滤掉。安全模式Safe Patterns直接放行以下只读/安全形式会先于危险检查被放行对应源码create_safe_patterns()Pattern NamePatterndd-file-outdd\s.*of[]?[^/\s]\.dd-discarddd\s.*of[]?/dev/(?:null\|zero\|full)[]?(?:\s\|$)lsblk\blsblk\bfdisk-listfdisk\s-lparted-printparted\b(?:\s--?\S)*\s(?:[]?/dev/\S[]?\s)?print(?:\s(?:devices\|free\|list\|all\|\d))?\s*$blkid\bblkid\bdf\bdf\bmount-list\bmount\s*$mkswap-checkmkswap\s(?:.*\s)?--check\bmdadm-detailmdadm\s--detail\bmdadm-examinemdadm\s--examine\bmdadm-querymdadm\s--query\bmdadm-query-shortmdadm\s-Q\bmdadm-scanmdadm\s--scan\bbtrfs-subvolume-listbtrfs\b(?:\s--?\S(?:\s\S)?)*\ssubvolume\slist(?\s\|$)btrfs-subvolume-showbtrfs\b(?:\s--?\S(?:\s\S)?)*\ssubvolume\sshow(?\s\|$)btrfs-filesystem-showbtrfs\b(?:\s--?\S(?:\s\S)?)*\sfilesystem\sshow(?\s\|$)btrfs-filesystem-dfbtrfs\b(?:\s--?\S(?:\s\S)?)*\sfilesystem\sdf(?\s\|$)btrfs-filesystem-usagebtrfs\b(?:\s--?\S(?:\s\S)?)*\sfilesystem\susage(?\s\|$)btrfs-device-statsbtrfs\b(?:\s--?\S(?:\s\S)?)*\sdevice\sstats(?\s\|$)btrfs-property-getbtrfs\b(?:\s--?\S(?:\s\S)?)*\sproperty\s(?:get\|list)(?\s\|$)btrfs-scrub-statusbtrfs\b(?:\s--?\S(?:\s\S)?)*\sscrub\sstatus(?\s\|$)dmsetup-lsdmsetup\b(?:\s--?\S(?:\s\S)?)*\sls(?\s\|$)dmsetup-statusdmsetup\b(?:\s--?\S(?:\s\S)?)*\sstatus(?\s\|$)dmsetup-infodmsetup\b(?:\s--?\S(?:\s\S)?)*\sinfo(?\s\|$)dmsetup-tabledmsetup\b(?:\s--?\S(?:\s\S)?)*\stable(?\s\|$)dmsetup-depsdmsetup\b(?:\s--?\S(?:\s\S)?)*\sdeps(?\s\|$)nbd-client-listnbd-client\s-l\bnbd-client-checknbd-client\s.*-check\bdiskutil-readonly(?i)diskutil\s(?:list\|info\|information\|activity\|listFilesystems\|apfs\slist(?:Snapshots\|Users)?)\b[^;\|\r\n]*$lvm-list\b(?:lvs\|vgs\|pvs)\blvm-display\b(?:lvdisplay\|vgdisplay\|pvdisplay)\blvm-scan\b(?:lvscan\|vgscan\|pvscan)\b这些安全模式的共同特征是只读巡查列出、查看、检查状态等操作不会改动数据。源码注释还揭示了两处刻意设计dd-discard显式接受可选引号of/dev/null因为 shell 在执行时会把引号剥掉模式必须两种拼写都能命中diskutil-readonly使用(?i)大小写不敏感匹配macOS 的 diskutil 接受任意大小写动词并以[^;|\r\n]*$结尾锚定使只读动词无法掩盖后续链式连接的破坏性命令——任何 shell 分隔符含换行都会结束白名单跨度若匹配失败则保守地落入危险检查。危险模式Destructive Patterns拦截以下模式匹配潜在破坏性命令均默认high严重级别diskutil 三类为criticalPattern NameReasonSeveritydd-devicedd to a block device will OVERWRITE all data on that device. Extremely dangerous!highdd-wipedd from /dev/zero or /dev/urandom to a device will WIPE all data!highfdisk-editfdisk can modify partition tables and cause data loss.highparted-modifyparted can modify partition tables and cause data loss.highmkfsmkfs formats a partition/device and ERASES all existing data.highmkswapmkswap formats a partition as a swap area, ERASING any existing data.highwipefswipefs removes filesystem signatures. Use with extreme caution.highmount-bind-rootmount --bind to root directory can have system-wide effects.highumount-forceumount -f force unmounts which may cause data loss if device is in use.highlosetup-devicelosetup modifies loop device associations. Verify before proceeding.highmdadm-stopmdadm --stop shuts down a RAID array. Data may become inaccessible.highmdadm-removemdadm --remove removes a drive from a RAID array. May cause data loss if redundancy is lost.highmdadm-failmdadm --fail marks a device as failed. Use only for intentional drive replacement.highmdadm-zero-superblockmdadm --zero-superblock PERMANENTLY erases RAID metadata. Array cannot be reassembled.highmdadm-createmdadm --create initializes a new RAID array, ERASING existing data on member devices.highmdadm-growmdadm --grow reshapes a RAID array. Interruption can cause data loss. Backup first.highbtrfs-subvolume-deletebtrfs subvolume delete PERMANENTLY removes a subvolume and all its data.highbtrfs-device-removebtrfs device remove redistributes data off a device. Interruption causes data loss.highbtrfs-device-addbtrfs device add incorporates a device into the filesystem. Verify the device is correct.highbtrfs-balancebtrfs balance redistributes data across devices. Can be slow and disruptive.highbtrfs-check-repairbtrfs check --repair is DANGEROUS and can cause data loss. Backup first!highbtrfs-rescuebtrfs rescue operations modify filesystem metadata. Use only as last resort.highbtrfs-filesystem-resizebtrfs filesystem resize can shrink a filesystem. Data loss if size is too small.highdmsetup-removedmsetup remove detaches a device-mapper device. May cause data loss if in use.highdmsetup-remove-alldmsetup remove_all removes ALL device-mapper devices. Extremely dangerous!highdmsetup-wipe-tabledmsetup wipe_table replaces the device table, causing all I/O to fail.highdmsetup-cleardmsetup clear removes the mapping table from a device.highdmsetup-loaddmsetup load changes device mapping. Verify the new table is correct.highdmsetup-createdmsetup create sets up a new device-mapper device. Verify parameters carefully.highnbd-client-disconnectnbd-client -d disconnects a network block device. Data loss if not properly unmounted.highnbd-client-connectnbd-client connecting a device can expose or overwrite data. Verify server and device.highpvremovepvremove ERASES LVM metadata from a physical volume. Data becomes inaccessible.highvgremovevgremove DELETES a volume group and all logical volumes within it.highlvremovelvremove PERMANENTLY deletes a logical volume and ALL its data.highvgreducevgreduce removes a physical volume from a volume group. Data may be lost.highlvreducelvreduce SHRINKS a logical volume. Data loss if filesystem isnt resized first!highlvresize-shrinklvresize with negative size SHRINKS the volume. Resize filesystem first or lose data!highpvmovepvmove migrates data between physical volumes. Do NOT interrupt or data may be lost.highlvconvert-mergelvconvert --merge reverts LV to snapshot state, discarding changes since snapshot.highdiskutil-erasediskutil erase operations DESTROY all data on the target disk or volume.criticaldiskutil-partitiondiskutil partitioning operations rewrite the partition map and erase data.criticaldiskutil-apfs-deletediskutil apfs delete/erase operations permanently remove APFS containers, volumes, or snapshots.critical源码级细节为什么这些规则这样写dd 引号绕过被闭合测试dd_quote_bypass_is_closeddd of/dev/sda在执行时剥引号变为of/dev/sda因此dd-device模式写作dd\s.*of[]?/dev/可选引号两种拼写都命中dd ifmyfile of/dev/null则被dd-discard白名单放行。全局 flag 位置不构成绕过测试btrfs_dmsetup_global_flags_do_not_bypassbtrfs 接受--format/--verbose等全局 flag 置于子命令前dmsetup 接受-v/--noudevsync等因此危险模式用btrfs\b.*?\ssubvolume\sdelete\b这类宽松跨度写法btrfs --format json subvolume delete /mnt/foo、dmsetup -v remove_all均被拦截。parted 的 print 前缀不能掩护修改测试parted_print_prefix_and_global_flags_do_not_bypass_modificationsGNU Parted 允许在设备后串联多条命令parted /dev/sda print rm 1、parted /dev/sda print mklabel gpt都会被parted-modify拦截因为安全模式parted-print被刻意收紧只放行以纯 print 形式结尾的只读命令。macOS diskutil 专项issue #305diskutil-erase/diskutil-partition/diskutil-apfs-delete三条规则均为critical并附有详细 explanation例如 erase 会清空整个 APFS 容器内所有卷、partitionDisk在写入新分区表前先擦除整盘且建议先diskutil list/diskutil apfs list检查目标。对应测试diskutil_destructive_operations_are_blocked_issue_305覆盖了eraseDisk/eraseVolume/reformat/zeroDisk/secureErase/partitionDisk/splitPartition/mergePartitions/apfs deleteContainer等拼写含大小写变体并验证diskutil list diskutil eraseDisk ...的链式命令仍被拦截。system.permissions权限修改防护Pack IDsystem.permissions防护对象是危险权限变更chmod 777造成全局可写、对系统目录的递归chmod/chown破坏系统权限与属主、setuid/setgid 位设置形成提权向量、以及递归setfacl改写全盘 ACL。关键词Keywordschmod、chown、chgrp、setfacl安全模式Safe Patterns直接放行Pattern NamePatternchmod-non-recursivechmod\s(?!-[rR])(?:\d{3,4}\|[ugoa][-][rwxXst])\s[^/]stat\bstat\bls-permsls\s.*-[a-zA-Z]*lgetfacl\bgetfacl\bnamei\bnamei\b即非递归的数字/符号模式 chmod且目标不是以/开头的路径、stat、ls -l、getfacl、namei等只读检查一律放行。危险模式Destructive Patterns拦截Pattern NameReasonSeveritychmod-777chmod 777 makes files world-writable. This is a security risk.highchmod-recursive-rootchmod -R on system directories can break system permissions.criticalchown-recursive-rootchown -R on system directories can break system ownership.highchmod-setuidSetting setuid bit (chmod us) is a security-sensitive operation.highchmod-setgidSetting setgid bit (chmod gs) is a security-sensitive operation.highchown-to-rootChanging ownership to root should be done carefully.highsetfacl-allsetfacl -R on system directories can modify access control across the filesystem.critical源码级细节安全替代建议与作用域控制拦截即给建议本包的多条规则携带PatternSuggestion见 src/packs/system/permissions.rs。例如chmod-777建议chmod 755 {path}属主可写、他人只读执行或chmod ux {path}只为属主加执行位chown-recursive-root建议先chown {user} {path}只改单个路径或用find {path} -maxdepth 1 -exec chown {user} {} \;限定顶层。这些建议会随拦截消息一起渲染帮助 Agent 自行修正为更安全的等价操作。可执行文件作用域issue #289本包每条规则都通过executables [...]声明自己针对的工具chmod/chown/setfacl。评估器要求整个正则匹配落在同一命令段内解析该段的 argv0剥离sudo/env等包装与前置赋值、去掉路径与扩展名、ASCII 大小写不敏感只有声明的可执行文件才会触发对应规则包含 shell 展开的动态 argv0 永不匹配。测试every_rule_declares_its_executable_issue_289强制校验了这一约束。递归系统目录保护的边界issue #301chmod-recursive-root覆盖系统目录清单bin/boot/dev/etc/lib64/lib/opt/proc/root/run/sbin/srv/sys/usr/var 等、裸/以及/home与 macOS/Users的家目录根或单用户家目录≤1 层~/.ssh所在层级而/home/user/project这类更深的项目路径保持放行避免误伤常规开发操作。测试recursive_root_covers_bare_slash_and_home_issue_301验证chown -R user /home被拦截但chmod -R 755 /home/user/project放行recursive_root_negative_boundaries_issue_301验证/homeworks、/etcetera等前缀共享路径不会误匹配。引号与命令替换不构成绕过issue #287chmod -R 0755 /etc、chmod -R $(cat modes.txt | head -1) /etc、chown -R u;g /etc、setfacl -R -m u:$(id -un | tr -d ):rwx /etc都会被拦截。源码注释说明引号内或$()内的分隔符不是命令段边界跨段抑制由评估器中的SEGMENT_SCOPED_PACKS机制完成而不是靠正则里的字符类边界后者会匹配换行导致跨命令误判。system.services服务与电源管理防护Pack IDsystem.services防护目标是停止/禁用关键服务sshd、network、docker 等导致失联或级联故障、systemctl isolate切换运行目标、以及关机/重启类电源操作。关键词Keywordssystemctl、service、init、upstart、shutdown、reboot安全模式Safe Patterns直接放行Pattern NamePatternsystemctl-statussystemctl\b(?:\s--?\S(?:\s\S)?)*\sstatus(?\s\|$)service-statusservice\s\S\sstatus(?\s\|$)systemctl-listsystemctl\b(?:\s--?\S(?:\s\S)?)*\slist-(?:units\|unit-files\|sockets\|timers)(?\s\|$)systemctl-showsystemctl\b(?:\s--?\S(?:\s\S)?)*\sshow(?\s\|$)systemctl-issystemctl\b(?:\s--?\S(?:\s\S)?)*\sis-(?:active\|enabled\|failed)(?\s\|$)systemctl-reloadsystemctl\b(?:\s--?\S(?:\s\S)?)*\sdaemon-reload(?\s\|$)systemctl-catsystemctl\b(?:\s--?\S(?:\s\S)?)*\scat(?\s\|$)journalctl\bjournalctl\b安全范围涵盖status/show/cat查看、list-*列举、is-active/is-enabled/is-failed状态查询、daemon-reload重载守护进程配置以及journalctl日志查看。这些模式统一采用systemctl\b(?:\s--?\S(?:\s\S)?)*\sverb(?\s|$)的写法以便正确跳过动词前的全局 flag如-H remote-host、--user、-M machine同时避免单位名包含动词子串如status-monitor.service时被安全模式短路。危险模式Destructive Patterns拦截Pattern NameReasonSeveritysystemctl-stop-criticalStopping/disabling critical services can cause system access loss or outage.highsystemctl-stopsystemctl stop/disable/mask affects service availability. Verify service name.highservice-stop-criticalStopping critical services can cause system access loss.highsystemctl-isolatesystemctl isolate changes the system state significantly.highsystemctl-powersystemctl poweroff/reboot/halt will shut down or restart the system.criticalshutdownshutdown will power off or restart the system.criticalrebootreboot will restart the system.criticalinit-levelinit 0 shuts down, init 6 reboots the system.critical源码级细节关键服务清单与安全替代关键服务名单systemctl-stop-critical和service-stop-critical都维护一份明确的服务名单。systemctl 版本为ssh|sshd|network|networking|firewalld|ufw|docker|containerdservice 版本为ssh|sshd|network|networking|docker。名单外的systemctl stop仍会被更宽泛的systemctl-stop拦截提示确认服务名实现关键服务高优先、任意服务不放过的双层策略。每条规则都附带处置建议explanation字段systemctl-stop-critical提示先systemctl status service查看状态、若需重启而非停止用systemctl restart servicesystemctl-power建议先who查看登录用户、用shutdown 5 ...优雅关机shutdown规则提示可用shutdown -c取消待执行的关机init-level建议在 systemd 系统上用systemctl poweroff/systemctl reboot替代init 0/init 6并可用runlevel查看当前运行级别。全局 flag 绕过防护测试systemctl_global_flags_do_not_bypasssystemctl -H remote-host stop sshd、systemctl --user disable my-unit、systemctl -M machine mask containerd、systemctl --system poweroff、systemctl -H host isolate rescue.target全部被拦截同时systemctl -H remote-host status sshd、systemctl --user list-units仍被安全模式放行——旧版systemctl\sverb的写法在出现全局 flag 时会静默绕过守卫这正是当前模式改为宽松 flag 跨度的原因。按规则粒度 Allowlist放行若某个具体规则在你的环境中属于可接受的运维操作例如已评估过风险的system.disk:mkswap可在 allowlist 中按规则名精确放行。规则名即上表 Pattern Name允许以system.disk:、system.permissions:、system.services:为前缀引用[[allow]] rule system.disk:mkfs reason Dev sandbox: 允许格式化临时挂载的测试卷放行整个 pack 的所有规则高风险需显式声明[[allow]] rule system.permissions:* reason 内部工具链需要递归调整用户目录权限 risk_acknowledged true按 docs/configuration.md 的说明有效 allowlist 按层级叠加项目.dcg/allowlist.toml需显式信任→ 用户~/.config/dcg/allowlist.toml→ 系统/etc/dcg/allowlist.toml。常用子命令包括dcg allowlist add、remove、prune。注意chmod-recursive-root、setfacl-all这类critical规则即使被warn/log策略放宽也需要单独的显式逐规则覆盖不能靠宽泛策略绕过。临时放行allow-once 流程除了持久化的 allowlistdcg 还提供 24 小时临时豁免。当 system 包拦截命令时输出中会附带一行 6 位数字代码例如ALLOW-24H CODE: [123456] | run: dcg allow-once 123456执行dcg allow-once 123456即可创建临时例外详见 docs/allow-once-usage.md。其关键属性例外仅作用于被拦截的那条精确命令 目录git 仓库内为项目根否则为当前目录24 小时后自动过期默认在过期前可重复使用也可创建单次使用例外所有例外都会写入审计日志。这使得 Agent 在误报例如合法的system.disk:dd-file-out之外的新写法时可以即时放行而无需削弱长期安全策略。严重级别与决策模式system.disk/system.services的电源与 shutdown 类、system.permissions的递归系统目录与 setfacl 类均为critical默认直接拒绝、不可被宽泛策略放松其余为high默认拒绝、可按规则 allowlist。severity 到决策模式的映射定义在 src/packs/mod.rs 的Severity::default_mode()Critical/High 默认denyMedium 默认warnLow 默认log。你可以在[policy]中做覆盖[policy] default_mode ask [policy.packs] system.services deny [policy.rules] system.disk:lvresize-shrink warn其中ask需要钩子协议支持操作员审批不支持的协议会以常规 deny 失败关闭fail closed。此外端到端测试脚本 scripts/e2e_destructive_equivalents.sh 的scenario_system_disk_default场景验证了mkfs.ext4 /dev/sda1system.disk:mkfs、mkswap /dev/sdbsystem.disk:mkswap、fdisk /dev/sdasystem.disk:fdisk-edit、parted -s /dev/sda mklabel gptsystem.disk:parted-modify、dd if/dev/zero of/dev/sda bs1Msystem.disk:dd-device、mdadm --zero-superblock /dev/sda、lvremove vg0/lv0、pvremove /dev/sda等命令的完整拦截链路——从关键词命中、pack 规则匹配到以system.disk:rule形式输出 denial。小结三层裁决链路与实战要点system 类别包的裁决链路可以总结为关键词快速拒绝 → 安全模式白名单短路 → 危险模式黑名单命中并输出规则名、severity、reason、explanation、suggestions再交由全局策略与 allowlist 决定最终动作。实战中建议先用dcg packs确认system.disk等默认启用状态再按需在[packs]中启用/禁用system类别或其子包面对被拦截的磁盘/权限/服务命令优先采纳 denial 消息中附带的更安全替代命令如chmod 755替代chmod 777、systemctl restart替代stop、shutdown 5替代立即关机确属必要的运维操作按规则粒度system.disk:pattern-name精确 allowlist或使用 24 小时allow-once临时放行避免使用system.disk:*全包放行通过 src/packs/system/disk.rs、src/packs/system/permissions.rs、src/packs/system/services.rs 中的单元测试以及 scripts/e2e_destructive_equivalents.sh 的端到端场景持续验证规则行为是否符合预期。【免费下载链接】destructive_command_guardThe Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents.项目地址: https://gitcode.com/GitHub_Trending/de/destructive_command_guard创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考