ljos-policyd

May this command line run?

May this command line run? First deny wins.

check / exec First deny wins uv first

Get started Reference

First minute

$ uvx ljos-policyd check -- uv run pytest
allow
$ uvx ljos-policyd check -- sudo id
deny    sudo

A Janet pack can deny more. It cannot allow what this binary denied.

(defn check [argv]
  (when (has-prefix? (get argv 0) "sudo")
    (deny "sudo")))

The seat composes that pack after this verdict: ljos policy -- uv run pytest.

Install

$ uvx ljos-policyd check -- uv run pytest
allow
$ cargo binstall ljos-policyd

exec runs the line only if the verdict is allow. A deny exits 2.

The tutorial is the same walk with exec and POLICYD_BIN.