# allow_reading.sh - let one program read from one address.
openshell policy update demo \
  --rule-name github_api \
  --binary /usr/bin/curl \
  --add-endpoint api.github.com:443:read-only:rest:enforce \
  --wait

# Reading works now. Writing does not.
openshell sandbox exec -n demo -- curl -sS https://api.github.com/zen
openshell sandbox exec -n demo -- curl -sS -X POST https://api.github.com/zen

# The rule names curl. Python is still shut out, even from the same address.
openshell sandbox upload demo ask_github.py
openshell sandbox exec -n demo -- python3 ask_github.py

# The log again. Lines with an arrow are connections, HTTP lines are requests.
sleep 3
openshell logs demo --source sandbox | grep -e '->' -e 'HTTP:'