jpmschweitzer
613ecb9fb1
The trailing wildcard on the three rm -rf deny entries spanned path separators, so Bash(rm -rf /*) matched every absolute path on the machine rather than the filesystem root, and the ~ and $HOME entries had the same shape. Narrowed to the exact literal forms. These rules match literal command text, so they still stop a typo on rm -rf /, rm -rf ~ or rm -rf $HOME exactly, but they no longer stop a recursive delete aimed at any other path. That reduced cover is deliberate, not an oversight.
71 lines
2.0 KiB
JSON
71 lines
2.0 KiB
JSON
{
|
|
"env": {
|
|
"PQL_VAULT": "/mnt/media/Projects/scheduler"
|
|
},
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(pql)",
|
|
"Bash(pql *)",
|
|
"Bash(/home/jpmschweitzer/.local/bin/pql:*)",
|
|
"Bash(git status:*)",
|
|
"Bash(git log:*)",
|
|
"Bash(git diff:*)",
|
|
"Bash(git branch:*)",
|
|
"Bash(.venv/bin/python -m pytest:*)",
|
|
"Bash(.venv/bin/pytest:*)",
|
|
"Bash(pytest:*)",
|
|
"Bash(docker logs scheduler:*)",
|
|
"Bash(curl -s http://localhost:8090/*)"
|
|
],
|
|
"deny": [
|
|
"Bash(/mnt/media/Projects/cladmin/ops/bin/toj)",
|
|
"Bash(/mnt/media/Projects/cladmin/ops/bin/toj:*)",
|
|
"Bash(chmod -R 777 *)",
|
|
"Bash(chmod 777 *)",
|
|
"Bash(dd if=*)",
|
|
"Bash(find * -delete*)",
|
|
"Bash(find * -exec*)",
|
|
"Bash(git * add --all*)",
|
|
"Bash(git * add -A*)",
|
|
"Bash(git * add .)",
|
|
"Bash(git * branch -D *)",
|
|
"Bash(git * checkout -- *)",
|
|
"Bash(git * clean -fd*)",
|
|
"Bash(git * clean -fdx*)",
|
|
"Bash(git * commit --no-verify*)",
|
|
"Bash(git * merge --no-ff*)",
|
|
"Bash(git * push --force*)",
|
|
"Bash(git * push -f*)",
|
|
"Bash(git * reset --hard*)",
|
|
"Bash(git * restore .*)",
|
|
"Bash(git add --all*)",
|
|
"Bash(git add -A*)",
|
|
"Bash(git add .)",
|
|
"Bash(git branch -D *)",
|
|
"Bash(git checkout -- *)",
|
|
"Bash(git clean -fd*)",
|
|
"Bash(git clean -fdx*)",
|
|
"Bash(git commit --no-verify*)",
|
|
"Bash(git merge --no-ff*)",
|
|
"Bash(git push --force*)",
|
|
"Bash(git push -f*)",
|
|
"Bash(git reset --hard*)",
|
|
"Bash(git restore .*)",
|
|
"Bash(mkfs*)",
|
|
"Bash(psql * -c DELETE FROM scheduled_tasks*)",
|
|
"Bash(psql * -c DROP*)",
|
|
"Bash(psql * DROP DATABASE*)",
|
|
"Bash(psql * TRUNCATE*)",
|
|
"Bash(redis-cli * FLUSHALL*)",
|
|
"Bash(redis-cli * FLUSHDB*)",
|
|
"Bash(rm -rf $HOME)",
|
|
"Bash(rm -rf /)",
|
|
"Bash(rm -rf ~)",
|
|
"Bash(su *)",
|
|
"Bash(sudo *)",
|
|
"Bash(toj)",
|
|
"Bash(toj:*)"
|
|
]
|
|
}
|
|
}
|