Explains how the Tauri runtime authority enforces security policies during application execution, covering ACL-based access control, capability resolution at runtime, scope injection, and command validation for secure IPC.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Explains how the Tauri runtime authority enforces security policies during application execution, covering ACL-based access control, capability resolution at runtime, scope injection, and command validation for secure IPC.
Tauri Runtime Authority
The runtime authority is a core Tauri component that enforces security policies during application execution. It validates permissions, resolves capabilities, and injects scopes before commands execute.
What Is Runtime Authority?
Runtime authority is the enforcement layer that sits between the WebView frontend and Tauri commands. It acts as a gatekeeper for all IPC (Inter-Process Communication) requests.
Core Function
When a webview invokes a Tauri command, the runtime authority:
Receives the invoke request from the webview
Validates the origin is permitted to call the requested command
Confirms the origin belongs to applicable capabilities
Injects defined scopes into the request
Passes the validated request to the Tauri command
If the origin is not allowed, the request is denied and the command never executes.
Trust Boundary Model
Tauri implements a trust boundary separating Rust core code from WebView frontend code:
Zone
Trust Level
Access
Rust Core
Full trust
Unrestricted system access
WebView Frontend
Limited trust
Only exposed resources via IPC
The runtime authority enforces this boundary at execution time.
Security Architecture
How Runtime Authority Fits
Frontend (WebView)
|
v
[IPC Invoke Request]
|
v
+------------------+
| Runtime Authority| <-- Validates permissions, capabilities, scopes
+------------------+
|
v (if allowed)
[Tauri Command Execution]
|
v
[System Resources]
Key Components
Component
Role in Runtime
Permissions
Define what commands exist and their access rules
Capabilities
Map permissions to specific windows/webviews
Scopes
Restrict command behavior with path/resource limits
Runtime Authority
Enforces all of the above at execution time
Capability Resolution at Runtime
When a command is invoked, the runtime authority resolves which capabilities apply.
Resolution Process
Identify Origin: Determine which window/webview made the request
Match Capabilities: Find all capabilities that include this window
Collect Permissions: Aggregate all permissions from matched capabilities
Check Command Access: Verify the command is allowed
Merge Scopes: Combine all applicable scope restrictions
Validate or Deny: Either proceed with scope injection or reject
Window Capability Merging
When a window is part of multiple capabilities, security boundaries merge:
Request to read $HOME/documents/file.txt - Allowed
Request to read $HOME/.ssh/id_rsa - Denied (deny rule matches)
Command-Level Validation
Before any command executes:
Runtime authority checks if the command permission exists
Verifies the calling window has that permission via its capabilities
Validates any scope restrictions are satisfied
Window "editor" calls fs.readFile("/home/user/doc.txt")
|
v
Runtime Authority checks:
- Does "editor" have fs:allow-read-file? Yes
- Is "/home/user/doc.txt" in allowed scope? Yes
- Is it in any deny scope? No
|
v
Command executes with scopes injected
Scope Injection
How Scopes Work at Runtime
Scopes are not just validation rules; they are injected into command execution context. Commands can access their applicable scopes to enforce restrictions.
Scope Variables
At runtime, scope variables resolve to actual paths:
Create distinct capabilities for different security contexts:
capabilities/
main-trusted.json # Full access for main window
plugin-limited.json # Restricted for plugin windows
preview-readonly.json # Read-only for preview
Platform-Specific Security
Use platform targeting for OS-specific permissions:
