MAELYS//DATALOGv0.11.1

Examples

ABAC for an interactive shell

Build a policy-aware pseudo-terminal and examine its security boundaries.

maelys-pty wraps a real interactive shell inside a pseudo-terminal and evaluates a Datalog policy before every command runs. This tutorial builds the wrapper in three levels of increasing rigour, with one page per level. Start at Level 1, then extend the same wrapper while examining the security gaps at each boundary.

Choose C or Python in the synchronized tabs. Both versions use the current opaque consumer API: C includes <maelys/datalog.h> and <maelys/datalog_builders.h>; Python imports maelys_datalog. Use the quickstart setup for Maelys Datalog 0.11.1. Scope: this is an integration walkthrough, not a production sandbox. The existing C terminal and syscall snippets are sketches requiring a complete native monitor; Python supplies policy evaluation, not a ptrace or seccomp implementation. Do not treat the line scanner, pathname resolution or these snippets as a security boundary.

Follow the three levels

Level 1 — Line filter with metachar scanInspect command lines, project metacharacters into facts, and query an explicit allow.Level 2 — Risk model and confirmationClassify risk, request confirmation, rebuild the context, and evaluate again.Level 3 — seccomp + execve + path resolution + envpExplore native exec monitoring, canonical paths, environment evidence and its limitations.

What you will learn

Learning objectives

Text inspection and kernel observation protect different boundaries
  • Inspect intent before parsing

    The line filter records shell metacharacters before tokenization. Pipes, redirects, substitutions, and separators therefore remain visible even when a tokenizer would split them away.

  • Re-evaluate after every challenge

    A user confirmation is not a cached authorization. The gate rebuilds the runtime facts and solves again immediately before use, reducing stale decisions while leaving check-to-execution races to the monitor.

  • Observe what the kernel will execute

    The syscall boundary reveals aliases, scripts, canonical paths, and the actual environment. Relative and symlinked binaries are resolved before policy sees them.

  • Combine layers instead of trusting one parser

    The PTY filter cheaply rejects dangerous command structure; exec monitoring catches what survives or appears later. Environment facts such as linker injection variables are denied independently of the command name.

Decision ruleCheck the typed command early, verify the real execve context late, and solve again whenever time or user interaction may have changed the facts.

Where to go next