0 Fork 0

Files

T

yinyues2 c64ed98eb1 claude-egress-guard 1.0.0

Fail-closed egress gate for Claude Code on Linux, packaged as an agent skill.

- binary-level gate at /usr/local/bin/claude and /usr/bin/claude with the real
  binary pinned under /opt/claude-real, so cron, Python, systemd and absolute
  paths are covered
- exit address and country checked before every start; mismatch or timeout
  refuses with exit 77 and never falls back to a direct connection
- optional kernel jail (systemd scope, IPAddressDeny=any) for the whole process
  tree, with loopback, proxy upstream, DNS resolvers and operator CIDRs allowed
- self-heal after package updates that rewrite /usr/bin/claude
- installer with dry-run, backups and uninstall; verify/verify --deep/status/drill
- sandboxed self-test suite, shellcheck and leak scanner in CI

2026-10-27 01:19:22 +08:00

1.9 KiB

Raw Blame History

Contributing

Thanks for taking a look. This is a security-adjacent tool, so the bar for changes is "does not weaken the default behaviour".

Ground rules

No real infrastructure in the repository. Use documentation address space (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24), example.com, and 127.0.0.1 for local endpoints. Never commit production IPs, hostnames, proxy credentials, subscription links, or account identifiers.
Fail closed. A new code path that can start Claude without a passing exit check will not be merged. If a check cannot run, refuse.
No new network calls. The checker talks to the endpoints in the config and nothing else.
No policy shortcuts. Do not add flags that silently disable a layer; make the trade-off explicit and documented, as --strict-net off does.

Style

Bash, 4-space-tab indentation, set -u, no eval, no unquoted expansions of paths.
Every script must pass shellcheck -x -S warning.
Prefer small functions with a single exit path; keep the gate readable, since operators are expected to audit it.
Comments explain why, not what.

Testing

bash skills/claude-egress-guard/scripts/selftest.sh
shellcheck -x -S warning skills/claude-egress-guard/scripts/*
python3 tools/leak-scan.py

Add a case to selftest.sh for every behaviour change. The suite runs in a temporary prefix with fake curl, id and systemd-run; it must stay root-free and network-free.

Pull requests

One concern per PR.
Describe the failure mode being fixed and the evidence that it is fixed.
If you change the config schema, update the template, the example in the README and the troubleshooting table in the same PR.

Commit messages

Short imperative subject, wrapped body explaining the failure and the fix.

Security issues

Do not open a public PR or issue for a bypass. Use the private reporting channel described in SECURITY.md.

1.9 KiB Raw Blame History