Getting started

A reader who has never used the binary can finish this page with one allow, one deny, and an exec that did not run.

1. Ask

$ ljos-policyd check -- uv run pytest
allow
$ ljos-policyd check -- sudo id
deny    sudo

uv run pytest is the line under test. A Janet pack can deny more after this verdict. A pack may only deny more.

Nothing is configured. The built-in denials are the whole trusted computing base: nothing else decides.

2. See a deny

$ ljos-policyd check -- sudo id
deny    sudo
$ echo $?
2

First matching deny wins. The reason is a short token after a tab (sudo, curl-pipe-shell, git-force-push, chmod-setuid, raw-disk, and more). The typed form is a Cap’n PolicyDecision:

$ ljos-policyd capnp -- true | wc -c
40

3. Exec only on allow

$ ljos-policyd exec -- true
$ echo $?
0
$ ljos-policyd exec -- sudo id
deny    sudo
$ echo $?
2

exec prints the deny on stderr and exits 2. The named program stays unrun.

4. Point the seat at it

$ command -v ljos-policyd
$ ljos doctor
ok  policyd ljos-policyd
$ ljos policy -- ls
ls
allow

ljos policy prints the line, then the built-in verdict if the binary answered, then any pack rule that matches. POLICYD_BIN names a binary that is not on PATH. POLICYD_REQUIRED=1 is fail-closed: a missing binary is then a deny.