Claude 安全隔离架构拆解：从消费端到企业端，三层防线怎么落地

# agent_policy.yaml — Agent 操作分级策略
sandbox:
  # 沙箱容器配置：无网络、受限文件系统
  container:
    image: agent-sandbox:latest
    network_mode: none          # 环境层隔离：物理断网
    read_only_root: true
    volumes:
      - ./workspace:/workspace  # 只挂载工作目录
    cap_drop:
      - ALL                     # 移除所有 Linux capabilities

permissions:
  # 低风险：自动放行
  auto_approve:
    - file_read
    - git_status
    - git_log
    - git_diff
    - shell_safe                # 白名单命令：ls, cat, grep, find, wc

  # 高风险：必须用户确认
  require_approval:
    - file_write
    - file_delete
    - git_push
    - git_commit
    - shell_unsafe              # 非白名单命令
    - package_install

audit:
  log_path: ./audit/agent_actions.jsonl
  real_time_stream: true        # 实时推送操作流给用户

# policy_engine.py — Agent 操作分级审批引擎
import json
import yaml
from pathlib import Path
from datetime import datetime

SAFE_COMMANDS = {"ls", "cat", "grep", "find", "wc", "head", "tail", "git", "echo"}

class AgentPolicyEngine:
    """根据策略配置，对 Agent 操作做分级审批和审计记录。"""

    def __init__(self, policy_path: str = "agent_policy.yaml"):
        with open(policy_path) as f:
            self.policy = yaml.safe_load(f)
        self.log_path = Path(self.policy["audit"]["log_path"])
        self.log_path.parent.mkdir(parents=True, exist_ok=True)

    def check_permission(self, action_type: str, action_detail: str) -> dict:
        """
        返回 {"approved": bool, "reason": str, "needs_user_confirm": bool}
        环境层隔离已由容器保证，这里做操作层分级。
        """
        auto = self.policy["permissions"]["auto_approve"]
        require = self.policy["permissions"]["require_approval"]

        # 判断操作类型归属
        if action_type in auto:
            # shell_safe 还需要检查具体命令是否在白名单
            if action_type == "shell_safe":
                base_cmd = action_detail.strip().split()[0]
                if base_cmd not in SAFE_COMMANDS:
                    return self._reject(
                        f"命令 '{base_cmd}' 不在安全白名单中", action_type, action_detail
                    )
            return self._approve(action_type, action_detail, needs_confirm=False)

        elif action_type in require:
            return self._approve(action_type, action_detail, needs_confirm=True)

        else:
            return self._reject(f"未知操作类型 '{action_type}'", action_type, action_detail)

    def _approve(self, action_type, action_detail, needs_confirm):
        self._log(action_type, action_detail, "approved", needs_confirm)
        return {
            "approved": True,
            "reason": "策略允许",
            "needs_user_confirm": needs_confirm,
        }

    def _reject(self, reason, action_type, action_detail):
        self._log(action_type, action_detail, "rejected", False)
        return {"approved": False, "reason": reason, "needs_user_confirm": False}

    def _log(self, action_type, action_detail, status, needs_confirm):
        entry = {
            "timestamp": datetime.utcnow().isoformat(),
            "action_type": action_type,
            "action_detail": action_detail,
            "status": status,
            "needs_user_confirm": needs_confirm,
        }
        with open(self.log_path, "a") as f:
            f.write(json.dumps(entry, ensure_ascii=False) + "\n")


# 使用示例
if __name__ == "__main__":
    engine = AgentPolicyEngine()

    # 低风险操作：自动放行
    result = engine.check_permission("file_read", "/workspace/src/main.py")
    print(result)  # approved=True, needs_user_confirm=False

    # 安全命令：自动放行
    result = engine.check_permission("shell_safe", "git status")
    print(result)  # approved=True, needs_user_confirm=False

    # 高风险操作：需要用户确认
    result = engine.check_permission("file_write", "/workspace/src/main.py")
    print(result)  # approved=True, needs_user_confirm=True

    # 非白名单命令：拒绝
    result = engine.check_permission("shell_safe", "rm -rf /workspace")
    print(result)  # approved=False

# 构建沙箱镜像（基于最小化基础镜像）
docker build -t agent-sandbox:latest -f Dockerfile.sandbox .

# Dockerfile.sandbox 内容：
# FROM python:3.12-slim
# RUN apt-get update && apt-get install -y git --no-install-recommends \
#     && rm -rf /var/lib/apt/lists/*
# WORKDIR /workspace
# COPY policy_engine.py /opt/policy_engine.py

# 启动沙箱容器：断网、只读根文件系统、只挂载工作目录
docker run -d \
  --name agent-sandbox-01 \
  --network none \
  --read-only \
  --tmpfs /tmp:size=100m \
  --tmpfs /run:size=10m \
  -v ./workspace:/workspace \
  --cap-drop ALL \
  agent-sandbox:latest \
  sleep infinity

# 在沙箱内执行 Agent 操作（通过 docker exec）
docker exec agent-sandbox-01 python /opt/policy_engine.py