dissimulo
a45f89b187
The previous snapshot of settings.json was a verbatim dump from one
Mastodon-server install — it carried allowlist entries that won't
match anywhere else and a lot of narrow rules already subsumed by
broader wildcards.
Removed (server-specific, dead weight on other hosts):
- /home/mastodon/* paths and Mastodon .env.production sed/chmod/chown
- signers.online and auto.signers.online curl/openssl probes
- mastodon-web / mastodon-streaming / mastodon-sidekiq journalctl
- n8n journalctl, windmill journalctl + binary
- /usr/local/bin/fail2ban-ignoreip and the hardcoded IP 76.95.82.63
- nslookup signers.live, nginx site-availables grep with literal paths
- /var/log/nginx/access.log* zcat probes (path-specific)
- StatusReactions / status_quoted grep over Mastodon's frontend tree
Removed (redundant, covered by broader wildcard already in the list):
- All narrow Bash(systemctl <verb>:*) entries — Bash(systemctl:*) covers
- All narrow Bash(git ...) entries — Bash(git:*) covers
- All narrow Bash(curl ...) probes — Bash(curl:*) covers
- Bash(rkhunter --update), Bash(rkhunter --propupd) — Bash(rkhunter:*) covers
- Bash(sysctl -a) — Bash(sysctl:*) covers
Kept: tmux/git/curl/sudo/find/ls/cat plus generic system-admin verbs
(systemctl, sysctl, crontab, iptables, ufw, firewall-cmd, fail2ban-client,
apt/apt-get/dpkg, mount, netstat, openssl, lsmod, last, nginx, redis-cli,
rkhunter, aideinit, getent, sqlite3, dig, ulimit, getenforce, aa-status)
plus Read(//home/**), Read(//opt/**), Read(//etc/nginx/sites-{enabled,available}/**).
Net: 5004 -> 1434 bytes (57 lines), still valid JSON, behavior on a
fresh host is identical for the kept verbs and tighter for the dropped
ones (host-specific allows just won't match anything anyway).
If you re-run install.sh on this host, the slim version replaces the
fat one; the fat one survives in ~/.drunkendotfiles.bak.<ts>/ for
recovery.
58 lines
1.4 KiB
JSON
58 lines
1.4 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(tmux source-file:*)",
|
|
"Bash(git:*)",
|
|
"Bash(curl:*)",
|
|
"Bash(sudo:*)",
|
|
"Bash(find:*)",
|
|
"Bash(ls:*)",
|
|
"Bash(cat:*)",
|
|
"Bash(systemctl:*)",
|
|
"Bash(sysctl:*)",
|
|
"Bash(crontab:*)",
|
|
"Bash(dig:*)",
|
|
"Bash(ulimit:*)",
|
|
"Bash(python3:*)",
|
|
"Bash(iptables:*)",
|
|
"Bash(ip6tables:*)",
|
|
"Bash(ufw status:*)",
|
|
"Bash(firewall-cmd:*)",
|
|
"Bash(apt list:*)",
|
|
"Bash(apt-get install:*)",
|
|
"Bash(apt-get upgrade:*)",
|
|
"Bash(dpkg:*)",
|
|
"Bash(fail2ban-client status:*)",
|
|
"Bash(fail2ban-client set:*)",
|
|
"Bash(aa-status)",
|
|
"Bash(getenforce)",
|
|
"Bash(mount)",
|
|
"Bash(netstat -tuln)",
|
|
"Bash(netstat -tlnp)",
|
|
"Bash(openssl x509:*)",
|
|
"Bash(openssl rand:*)",
|
|
"Bash(grep -v \"^$\")",
|
|
"Bash(du -sh /var/log/*)",
|
|
"Bash(lsmod)",
|
|
"Bash(xargs ls:*)",
|
|
"Bash(last:*)",
|
|
"Bash(nginx:*)",
|
|
"Bash(redis-cli:*)",
|
|
"Bash(rkhunter:*)",
|
|
"Bash(aideinit)",
|
|
"Bash(npm --version)",
|
|
"Bash(ruby --version)",
|
|
"Bash(getent passwd:*)",
|
|
"Bash(sqlite3:*)",
|
|
"Read(//home/**)",
|
|
"Read(//opt/**)",
|
|
"Read(//etc/nginx/sites-enabled/**)",
|
|
"Read(//etc/nginx/sites-available/**)"
|
|
],
|
|
"defaultMode": "auto"
|
|
},
|
|
"theme": "dark",
|
|
"verbose": true,
|
|
"skipAutoPermissionPrompt": true
|
|
}
|