feat: Implement immutable DMS command policy

- Added pre-run checks for greeter and setup commands to enforce policy restrictions - Created cli-policy.default.json to define blocked commands and user messages for immutable environments.
2026-06-08 12:13:31 -04:00 · 2026-03-05 23:08:27 -05:00
parent fe5bd42e25
commit 1eca9b4c2c
5 changed files with 306 additions and 14 deletions
@@ -0,0 +1,10 @@
+{
+  "policy_version": 1,
+  "blocked_commands": [
+    "greeter install",
+    "greeter enable",
+    "greeter sync",
+    "setup"
+  ],
+  "message": "This command is disabled on immutable/image-based systems. Use your distro-native workflow for system-level changes."
+}