ljos-policyd

ljos-policyd

May this command line run?

May this command line run? First deny wins.

check / exec / capnp First deny wins uv first

Get started Reference

First minute

$ ljos-policyd check -- uv run pytest
allow
$ ljos-policyd check -- sudo id
deny    sudo

Typed verdict is Cap’n PolicyDecision (phronesis; Ali Akber Saifee / indynull, HaoZeke). A Janet pack can deny more. A pack may only deny more.

(defn check [argv]
  (when (has-prefix? (get argv 0) "sudo")
    (deny "sudo")))

The seat composes that pack after this verdict: ljos policy -- uv run pytest.

Install

$ cargo binstall ljos-policyd
$ ljos-policyd check -- uv run pytest
allow

exec runs the line only if the verdict is allow. A deny exits 2.

The tutorial is the same walk with exec and POLICYD_BIN.