Security, Permissions, and Trust Boundaries
A source-linked explanation of permission classes, file/network scopes, safe mode, package-manager constraints, FFI, and sandbox limitations.
Runtime permissions
Default permissions and classes
README states programs have all permissions by default. Six classes can be restricted: read, write, network, execute, environment, and native; الكل groups them. --اسمح=classes grants the named classes and denies the rest; --امنع=classes withdraws named permissions.
| Example | Documented effect |
|---|---|
--اسمح=قراءة | Allows read and denies the other classes. |
--امنع=تنفيذ,شبكة | Starts with permissions allowed, then withdraws execute and network. |
--اسمح-قراءة=/data / --اسمح-كتابة=/output | Scopes file access to paths, checked after resolving symlinks and ... |
--اسمح-شبكة=example.com | Scopes network access to the exact host or a subdomain. |
--آمن or SOLAN_SAFE=1 | Safe mode is documented as read and environment only. |
solan --اسمح-قراءة=/بيانات --اسمح-كتابة=/مخرجات --اسمح-شبكة=api.example.com script.سو
solan --امنع=تنفيذ,شبكة script.سو
solan --آمن script.سوSupply chain
Package constraints and integrity
| Control | README limit or behavior |
|---|---|
| Code execution during install | Library scripts are not executed during installation or publication. |
| Symbolic links | Forbidden in installed/published libraries. |
| Size and count | Up to 5,000 files and 50 MiB per package. |
| Dependencies | Depth up to 16 and up to 500 packages. |
| Git sources | Only https/http/ssh/git/file; ext:: is rejected. |
| Lockfile | Records commit and SHA-256; install --frozen and verify check integrity. README says there is no digital signature. |
A locked commit/hash detects content changes relative to the lockfile; it does not by itself prove publisher identity or replace a digital signature.
Trust limits
Not a full sandbox
- README explicitly warns that safe mode and permissions are not a full operating-system sandbox. Treat them as Solan-level restrictions, not process isolation or protection from every OS vulnerability.
- Native modules and FFI require
اصليbut execute C code in-process; do not grant it to untrusted code. - Because all permissions are granted by default, running untrusted programs is unsafe unless a least-privilege policy is applied.
- Keep TLS verification enabled for HTTPS/WSS; disabling it weakens trust rather than fixing it.
Use the project’s SECURITY.md reporting channel for vulnerability reports. This page is an engineering reference, not an independent audit or safety guarantee.
Source files
Direct links pinned to the source snapshot used by this reference; the main branch may change later.