{"version":"2.1.242","anchor":"permission-rules-are-screened-before-they-leave-the-machine","canonical_anchor":"permission-rules-are-screened-before-they-leave-the-machine","heading":"Permission rules are screened before they leave the machine","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242\/e\/permission-rules-are-screened-before-they-leave-the-machine","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.242","markdown":"### Permission rules are screened before they leave the machine\n\nPermission rules that reach outside the project or only fit your device are not forwarded to the cloud.\n\n**What**\n\nEach permission rule forwarded to a cloud session is classified first. Rules that reach outside the project are dropped as rooted, rules that only make sense on your own device are dropped as device, malformed rules as invalid, and rules past the count or length caps as over_cap. The rest are kept.\n\n**Details**\n\n- Screening walks through wrapper commands (sudo, doas, env, timeout, xargs and others) to find the real command underneath.\n- It knows a large table of network-capable commands including curl, wget, ssh, psql, mongosh and invoke-webrequest.\n- It also flags arguments that bind a server to any address, such as --host, --bind or HOST= with values like 0.0.0.0, :: or localhost.\n- Counts of what was dropped are reported as droppedRooted, droppedDevice, droppedInvalid, droppedOverCap and droppedGuarded.\n\n**Evidence**\n\n`keep_covers_device_tools`\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}