Cygwin

Validate Cygwin shell tooling (curl/wget/ssh/scp/sftp, git) under the Secure Sandbox for egress controls, IPv6 parity, localhost isolation, and interactions with Storage Contexts and mounts.

Objectives

• Enforce deny-by-default egress, proxy enforcement, and pinned roots for command-line tools.
• Block direct IP, IPv6, DNS-over-HTTPS, and UDP/QUIC when not allowed.
• Verify writes stay within Storage Context boundaries; block UNC/SMB egress.
• Validate clipboard data-motion controls for terminal copy/paste and large-paste DLP.

Preconditions

• Windows target with Turbo Launcher and Secure Sandbox.
• Cygwin installed. Recommended packages: curl, wget, git, openssh (ssh/sftp), and optionally bind-utils/bind (dig) and netcat/ncat (nc).
• Networking deny-by-default posture with proxy enforcement and pinned roots.

Controls Under Test

• runtime.networking.egressDefaultAction, designated proxy enforcement, and pinned roots.
• runtime.files.contexts and file operation policies.
• runtime.dataMotion.rules[] with channel: "clipboard".

Test Scenarios

ID	Canonical ID	Scenario	Procedure	Expected Outcome
SCEN-TOOL-CYGWIN-01	NET-EGRESS-01	Direct IP (curl)	curl -v --connect-timeout 5 http://1.1.1.1	Denied; timeout/refused. Audit shows action: "deny".
SCEN-TOOL-CYGWIN-02	NET-EGRESS-11	IPv6 literal (curl)	curl -v -g -6 --connect-timeout 5 https://[2606:4700:4700::1111]/	Denied; ipVersion: 6, action: deny.
SCEN-TOOL-CYGWIN-03	NET-DNS-02	DoH over HTTPS	curl -sS -H 'accept: application/dns-json' 'https://dns.google/dns-query?name=example.com'	Denied; reason: "dohBlocked"; proxy enforced.
SCEN-TOOL-CYGWIN-04	NET-EGRESS-03	Direct DNS (UDP/53)	dig @8.8.8.8 example.com +time=5	Denied/timeout; protocol: udp.
SCEN-TOOL-CYGWIN-05	NET-EGRESS-01	SSH to non-allowlisted host	ssh -v -o ConnectTimeout=5 [email protected]	Denied; timeout/refused on tcp/22.
SCEN-TOOL-CYGWIN-06	NET-EGRESS-13	Bash /dev/tcp	echo "GET / HTTP/1.1" > /dev/tcp/1.1.1.1/80	Denied; permission error or timeout/refused.
SCEN-TOOL-CYGWIN-07	NET-EGRESS-13	Raw TCP (nc)	nc -vz 1.1.1.1 443 (if nc installed)	Denied; protocol: tcp, action: deny.
SCEN-TOOL-CYGWIN-08	NET-EGRESS-05	Unauthorized proxy env	HTTPS_PROXY=http://attacker:8080 curl https://example.com	Denied; reason: "unauthorizedProxy", proxyEnforced: true.
SCEN-TOOL-CYGWIN-09	NET-EGRESS-06	NO_PROXY bypass	NO_PROXY=* curl https://example.com	Denied; reason: "proxyBypassAttempt", proxyEnforced: true.
SCEN-TOOL-CYGWIN-10	NET-EGRESS-12	CONNECT to non-proxy	curl -v --proxy https://nonproxy.example:443 https://target.example	Denied; reason: "destNotProxy", proxyEnforced: true.
SCEN-TOOL-CYGWIN-11	NET-EGRESS-09	Proxy fail-closed	Take designated proxy down; curl https://example.com	Denied; reason: "proxyUnavailable"; no direct fallback.
SCEN-TOOL-CYGWIN-12	NET-EGRESS-10	Proxy identity/pinning	Intercept proxy TLS with wrong CA; curl https://example.com	TLS error; `reason: "certMismatch"
SCEN-TOOL-CYGWIN-13	NET-EGRESS-01	Git over HTTPS	git clone https://example.com/repo.git	Denied unless allowlisted; proxy/pinning enforced; audit network event.
SCEN-TOOL-CYGWIN-14	NET-EGRESS-01	Git over SSH	git clone ssh://[email protected]/repo.git or git@host:repo	Denied (tcp/22) without allowlist.
SCEN-TOOL-CYGWIN-15	NET-EGRESS-07	wget TLS bypass attempt	wget --no-check-certificate https://example.com	Denied at boundary; client flag ineffective.
SCEN-TOOL-CYGWIN-16	NET-ISOLATE-01	Localhost isolation	curl -v http://127.0.0.1:80	Denied; localhost not reachable externally.
SCEN-TOOL-CYGWIN-17	HARD-FILES-01	Protected host path	touch /cygdrive/c/Windows/System32/drivers/etc/hosts	Denied (Permission denied/Read-only file system) or virtualized.
SCEN-TOOL-CYGWIN-18	HARD-FILES-01	UNC/SMB write attempt	cp test.txt //server/share/ or /cygdrive/unc/server/share	Denied; SMB egress blocked; audit fileOp deny.
SCEN-TOOL-CYGWIN-19	HARD-FILES-01	SFTP download within context	sftp user@allowlisted → get sample.txt	Files land only in overlay/allowed Storage Contexts; no writes to blocked paths.
SCEN-TOOL-CYGWIN-20	DM-CLIP-01	Clipboard outbound (terminal)	Copy from terminal (mintty) and paste on host.	Denied/processed per policy; audit dataMotion clipboard event.
SCEN-TOOL-CYGWIN-21	DM-CLIP-04	Large paste DLP	Paste >policy-limit base64 into terminal; run base64 -d to file	Paste denied; channel: "clipboard", action: "deny".

Evidence Requirements

• network events: protocol/alpn (when available), destination/sni as applicable, ipVersion for IPv6 tests, action, outcome, proxyEnforced, and reason (unauthorizedProxy, proxyBypassAttempt, destNotProxy, proxyUnavailable, certMismatch, pinningFailed, dohBlocked).
• fileOp events: attempted writes to protected host paths or UNC; include path, action/outcome (deny/virtualized), and context identifiers.
• dataMotion events: channel (clipboard), direction (out), action, outcome, rule.id, priority.

Example audit event (proxy fail-closed during curl):

{
  "category": "network",
  "action": "egress",
  "outcome": "deny",
  "destination": "example.com:443",
  "sni": "example.com",
  "alpn": "h2",
  "proxyEnforced": true,
  "reason": "proxyUnavailable",
  "rule": { "id": "NET-EGRESS-09", "priority": 80 }
}

Troubleshooting

• Environment variables like HTTP_PROXY/HTTPS_PROXY/NO_PROXY may influence client behavior, but the sandbox should enforce the designated proxy regardless.
• Some tools retry or cache DNS; keep attempts short (--connect-timeout, +time=5) and monitor audit across a sufficient window.
• Terminal differences: Cygwin mintty integrates with the Windows clipboard; if you use a conhost-based shell, copy/paste gestures differ but the clipboard policy still applies.
• /dev/tcp is a Bash feature and may be disabled in some builds; use nc where available as an alternative raw-socket check.
• UNC paths under Cygwin can appear as //server/share or /cygdrive/unc/server/share depending on configuration.

Known Limitations & Negative Space

• Package availability varies; if nc/dig is missing, prefer /dev/tcp and HTTPS-based DoH checks with curl.
• PAC/WPAD scenarios are generally exercised with desktop apps and browsers; they are not covered here for Cygwin tools.