Web UI

Warning

Experimental.

hallpass web

hallpass web serves a page on 127.0.0.1 that shows every session of the user: the pending requests with the same answers as the terminal, the activity (every decided access, filterable) and the rules, which can be edited. Open the address it prints: the page shows a pairing code, and hallpass web asks in its terminal "Pair the browser showing 482 913? [y/n]". Answer y only if the page shows the same code. --open opens the page with xdg-open, --listen picks the address (loopback only).

The same request shows in the terminal and in the browser; answering in the browser takes the terminal prompt down.

--node ADDR follows the sessions of a Kubernetes node agent instead of this user's (see Kubernetes: answer requests).

Editing rules

The Rules tab of a session lists its rules. Edit turns a rule into a text field in the rule syntax, for example to narrow allow write ~/.cache/** to ~/.cache/pip/**; Enter saves, Esc cancels. Delete removes the rule, and Add rule adds one. An allow rule gives at most what answering "always" would; the page shows why a change is refused. Changes apply to this session only.

Narrowing an "always" answer, adding a deny rule, and the limit: an allow rule cannot give more than "always" could.

From a session

A session can open a web UI for itself only: press Ctrl-] then w in its terminal, w in a terminal prompt, or click "Open web UI" on its desktop notification. hallpass opens the page with xdg-open and asks you to confirm its pairing code in the terminal's overlay, or in a second notification with [Pair] and [Cancel]. Each "open" lets one browser pair, within a minute. While the page has the focus, the session's requests get no desktop notification. The page links to hallpass web for all sessions.

Security

The page keeps its credential in memory only, never in a cookie. A new tab of the same web UI takes it from an already paired tab, without a code; with no paired tab left, the page pairs again. The title says which web UI it is: "hallpass: session PID" or "hallpass web: all sessions". A sandboxed agent can still connect to the port and start its own pairing, hoping you confirm its code: compare the codes, and if hallpass web warns that something else tried to pair, find out what. Sessions that mediate the network (--mediate=write,exec,connect) deny their sandbox every connection to the web UI's port, and to the session sockets, even with --allow-connect=all: no answer or rule lifts that. Without network mediation, the port is reachable. See docs/devel/web.md and protected denials.