From 3437590d44fbb6768835bead7f77b173238eeb73 Mon Sep 17 00:00:00 2001
From: fontvielle <fontvielle@localhost.localdomain>
Date: Thu, 14 May 2026 00:30:30 +0300
Subject: [PATCH] =?UTF-8?q?chore(claude):=20=D1=81=D1=83=D0=B7=D0=B8=D1=82?=
 =?UTF-8?q?=D1=8C=20sudo-deny=20=D0=B8=20=D1=80=D0=B0=D0=B7=D1=80=D0=B5?=
 =?UTF-8?q?=D1=88=D0=B8=D1=82=D1=8C=20=D1=83=D1=81=D1=82=D0=B0=D0=BD=D0=BE?=
 =?UTF-8?q?=D0=B2=D0=BE=D1=87=D0=BD=D1=8B=D0=B5=20=D0=BA=D0=BE=D0=BC=D0=B0?=
 =?UTF-8?q?=D0=BD=D0=B4=D1=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Замена широкого Bash(sudo *) deny на узкие опасные паттерны
(sudo rm/dd/mkfs/passwd/userdel/usermod/visudo/su/-s/-i),
добавление в allow: sudo dnf/rpm/tar/ln/cp/mv/chmod/chown/systemctl,
sudo tee /etc/profile.d/*, curl/wget. Нужно, чтобы Claude Code
автоматически устанавливал пакеты при подготовке dev-стенда.
Write-deny на /etc, /var, /root, /home/admin сохранён.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .claude/settings.json | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 072503c..67ce7b9 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -23,13 +23,36 @@
       "Bash(find *)",
       "Bash(npm run *)",
       "Bash(npx *)",
-      "Bash(./scripts/*)"
+      "Bash(./scripts/*)",
+      "Bash(sudo dnf *)",
+      "Bash(sudo rpm *)",
+      "Bash(sudo tar *)",
+      "Bash(sudo ln *)",
+      "Bash(sudo mkdir *)",
+      "Bash(sudo cp *)",
+      "Bash(sudo mv *)",
+      "Bash(sudo chmod *)",
+      "Bash(sudo chown *)",
+      "Bash(sudo systemctl *)",
+      "Bash(sudo tee /etc/profile.d/*)",
+      "Bash(sudo update-alternatives *)",
+      "Bash(curl *)",
+      "Bash(wget *)"
     ],
     "deny": [
       "Bash(rm -rf /*)",
       "Bash(rm -rf ~)",
       "Bash(rm -rf $HOME)",
-      "Bash(sudo *)",
+      "Bash(sudo rm *)",
+      "Bash(sudo dd *)",
+      "Bash(sudo mkfs *)",
+      "Bash(sudo passwd *)",
+      "Bash(sudo userdel *)",
+      "Bash(sudo usermod *)",
+      "Bash(sudo visudo *)",
+      "Bash(sudo su *)",
+      "Bash(sudo -s)",
+      "Bash(sudo -i)",
       "Bash(dd *)",
       "Bash(mkfs *)",
       "Bash(curl * | sh)",