fontvielle
3437590d44
Замена широкого Bash(sudo *) deny на узкие опасные паттерны (sudo rm/dd/mkfs/passwd/userdel/usermod/visudo/su/-s/-i), добавление в allow: sudo dnf/rpm/tar/ln/cp/mv/chmod/chown/systemctl, sudo tee /etc/profile.d/*, curl/wget. Нужно, чтобы Claude Code автоматически устанавливал пакеты при подготовке dev-стенда. Write-deny на /etc, /var, /root, /home/admin сохранён. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
74 lines
1.8 KiB
JSON
74 lines
1.8 KiB
JSON
{
|
|
"$schema": "https://json.schemastore.org/claude-code-settings.json",
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(go *)",
|
|
"Bash(make *)",
|
|
"Bash(git status)",
|
|
"Bash(git diff *)",
|
|
"Bash(git log *)",
|
|
"Bash(git branch *)",
|
|
"Bash(git fetch *)",
|
|
"Bash(git pull *)",
|
|
"Bash(git remote -v)",
|
|
"Bash(podman *)",
|
|
"Bash(podman-compose *)",
|
|
"Bash(docker *)",
|
|
"Bash(docker-compose *)",
|
|
"Bash(xmlstarlet *)",
|
|
"Bash(jq *)",
|
|
"Bash(ls *)",
|
|
"Bash(cat *)",
|
|
"Bash(grep *)",
|
|
"Bash(find *)",
|
|
"Bash(npm run *)",
|
|
"Bash(npx *)",
|
|
"Bash(./scripts/*)",
|
|
"Bash(sudo dnf *)",
|
|
"Bash(sudo rpm *)",
|
|
"Bash(sudo tar *)",
|
|
"Bash(sudo ln *)",
|
|
"Bash(sudo mkdir *)",
|
|
"Bash(sudo cp *)",
|
|
"Bash(sudo mv *)",
|
|
"Bash(sudo chmod *)",
|
|
"Bash(sudo chown *)",
|
|
"Bash(sudo systemctl *)",
|
|
"Bash(sudo tee /etc/profile.d/*)",
|
|
"Bash(sudo update-alternatives *)",
|
|
"Bash(curl *)",
|
|
"Bash(wget *)"
|
|
],
|
|
"deny": [
|
|
"Bash(rm -rf /*)",
|
|
"Bash(rm -rf ~)",
|
|
"Bash(rm -rf $HOME)",
|
|
"Bash(sudo rm *)",
|
|
"Bash(sudo dd *)",
|
|
"Bash(sudo mkfs *)",
|
|
"Bash(sudo passwd *)",
|
|
"Bash(sudo userdel *)",
|
|
"Bash(sudo usermod *)",
|
|
"Bash(sudo visudo *)",
|
|
"Bash(sudo su *)",
|
|
"Bash(sudo -s)",
|
|
"Bash(sudo -i)",
|
|
"Bash(dd *)",
|
|
"Bash(mkfs *)",
|
|
"Bash(curl * | sh)",
|
|
"Bash(curl * | bash)",
|
|
"Bash(wget * | sh)",
|
|
"Bash(wget * | bash)",
|
|
"Read(/etc/cryptopro/**)",
|
|
"Read(/var/cryptopro/**)",
|
|
"Read(/etc/ipsec.d/**)",
|
|
"Read(/root/**)",
|
|
"Read(/home/admin/**)",
|
|
"Write(/etc/**)",
|
|
"Write(/var/**)",
|
|
"Write(/root/**)",
|
|
"Write(/home/admin/**)"
|
|
]
|
|
}
|
|
}
|