Blomios
40bce5c8bf
Un allowlist Landlock ne peut que retirer des accès (deny-by-default). Sous une fallback Posture::Allow (allow-by-default), enforcer les grants verrouillerait tout hors du project root — binaire CLI, libs et ~/.<cli> — provoquant le 'failed to open terminal'. On n'enforce donc rien sous Allow ; seuls les Deny explicites font foi (advisory via la projection LP3). Couvre permissions.json persisté avec fallback allow. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
646 B
JSON
39 lines
646 B
JSON
{
|
|
"version": 1,
|
|
"projectDefaults": {
|
|
"rules": [
|
|
{
|
|
"capability": "read",
|
|
"effect": "allow",
|
|
"paths": [
|
|
"**"
|
|
],
|
|
"commands": []
|
|
},
|
|
{
|
|
"capability": "write",
|
|
"effect": "allow",
|
|
"paths": [
|
|
"**"
|
|
],
|
|
"commands": []
|
|
},
|
|
{
|
|
"capability": "delete",
|
|
"effect": "allow",
|
|
"paths": [
|
|
"**"
|
|
],
|
|
"commands": []
|
|
},
|
|
{
|
|
"capability": "executeBash",
|
|
"effect": "allow",
|
|
"paths": [],
|
|
"commands": []
|
|
}
|
|
],
|
|
"fallback": "allow"
|
|
}
|
|
}
|