rubik 0.1.0

data/lib/rubik/security/classifier/commands/javac.yaml

@@ -0,0 +1,39 @@
+# $schema: ../../../schemas/command.schema.json
+command: javac
+description: "Java compiler"
+classification: LOCAL_EFFECTS
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+  -help: {overrides: READONLY}
+options:
+  --version: {overrides: READONLY}
+  -version: {overrides: READONLY}
+  -d: {takes_value: true}
+  -s: {takes_value: true}
+  -h: {takes_value: true}
+  -cp: {takes_value: true}
+  -classpath: {takes_value: true}
+  --class-path: {takes_value: true, aliases: [-cp, -classpath]}
+  -sourcepath: {takes_value: true}
+  --source-path: {takes_value: true, aliases: [-sourcepath]}
+  -p: {takes_value: true}
+  --module-path: {takes_value: true, aliases: [-p]}
+  --add-modules: {takes_value: true}
+  --add-exports: {takes_value: true}
+  --add-reads: {takes_value: true}
+  -source: {takes_value: true}
+  --source: {takes_value: true, aliases: [-source]}
+  -target: {takes_value: true}
+  --target: {takes_value: true, aliases: [-target]}
+  --release: {takes_value: true}
+  -encoding: {takes_value: true}
+  -g: {}
+  -deprecation: {}
+  -nowarn: {}
+  -verbose: {}
+  -proc: {takes_value: true}
+  -processor: {takes_value: true}
+  --enable-preview: {}
+  -Xlint: {}
+  -parameters: {}

data/lib/rubik/security/classifier/commands/join.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: join
+description: "Join lines of two files on a common field"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/journalctl.yaml

@@ -0,0 +1,14 @@
+# $schema: ../../../schemas/command.schema.json
+command: journalctl
+description: "Query the systemd journal"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+options:
+  --flush: {overrides: EXTERNAL_EFFECTS}
+  --rotate: {overrides: EXTERNAL_EFFECTS}
+  --sync: {overrides: EXTERNAL_EFFECTS}
+  --vacuum-size: {takes_value: true, overrides: DANGEROUS}
+  --vacuum-time: {takes_value: true, overrides: DANGEROUS}
+  --vacuum-files: {takes_value: true, overrides: DANGEROUS}

data/lib/rubik/security/classifier/commands/jq.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: jq
+description: "Command-line JSON processor"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/kill.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: kill
+description: "Send signals to processes"
+classification: DANGEROUS
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/killall.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: killall
+description: "Kill processes by name"
+classification: DANGEROUS
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/kubectl.yaml

@@ -0,0 +1,211 @@
+# $schema: ../../../schemas/command.schema.json
+command: kubectl
+description: "Kubernetes command-line tool"
+classification: EXTERNAL_EFFECTS
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+  --context: {takes_value: true}
+  --kubeconfig: {takes_value: true}
+  --namespace: {takes_value: true, aliases: [-n]}
+  --cluster: {takes_value: true}
+  --server: {takes_value: true, aliases: [-s]}
+  --token: {takes_value: true}
+  --as: {takes_value: true}
+  --as-group: {takes_value: true}
+  --certificate-authority: {takes_value: true}
+  --client-certificate: {takes_value: true}
+  --client-key: {takes_value: true}
+  --insecure-skip-tls-verify: {}
+  --tls-server-name: {takes_value: true}
+  --v: {takes_value: true}
+  --request-timeout: {takes_value: true}
+
+subcommands:
+  get:
+    classification: READONLY
+    strict: false
+    options:
+      -o: {takes_value: true}
+      --output: {takes_value: true, aliases: [-o]}
+
+  describe:
+    classification: READONLY
+    strict: false
+    options:
+      -o: {takes_value: true}
+      --output: {takes_value: true, aliases: [-o]}
+
+  logs:
+    classification: READONLY
+    strict: false
+
+  top:
+    classification: READONLY
+
+  api-resources:
+    classification: READONLY
+
+  api-versions:
+    classification: READONLY
+
+  explain:
+    classification: READONLY
+
+  version:
+    classification: READONLY
+
+  cluster-info:
+    classification: READONLY
+
+  auth:
+    subcommands:
+      can-i:
+        classification: READONLY
+      reconcile:
+        classification: EXTERNAL_EFFECTS
+
+  apply:
+    classification: EXTERNAL_EFFECTS
+    options:
+      --dry-run: {takes_value: true, overrides: READONLY}
+      -f: {takes_value: true}
+      --filename: {takes_value: true, aliases: [-f]}
+
+  create:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+    options:
+      --dry-run: {takes_value: true, overrides: READONLY}
+      -f: {takes_value: true}
+      --filename: {takes_value: true, aliases: [-f]}
+
+  delete:
+    classification: DANGEROUS
+    options:
+      --dry-run: {takes_value: true, overrides: READONLY}
+      -f: {takes_value: true}
+      --filename: {takes_value: true, aliases: [-f]}
+
+  edit:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  patch:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  scale:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  rollout:
+    subcommands:
+      status:
+        classification: READONLY
+      history:
+        classification: READONLY
+      restart:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+      undo:
+        classification: DANGEROUS
+        strict: false
+      pause:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+      resume:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+
+  exec:
+    classification: DANGEROUS
+    strict: false
+    delegates_to:
+      mode: after_separator
+      separator: "--"
+      min_classification: EXTERNAL_EFFECTS
+    options:
+      -it: {}
+      -i: {}
+      --stdin: {aliases: [-i]}
+      -t: {}
+      --tty: {aliases: [-t]}
+      -c: {takes_value: true}
+      --container: {takes_value: true, aliases: [-c]}
+      -n: {takes_value: true}
+      --namespace: {takes_value: true, aliases: [-n]}
+
+  port-forward:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  cp:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  drain:
+    classification: DANGEROUS
+    strict: false
+
+  cordon:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  uncordon:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  taint:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  label:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  annotate:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+
+  config:
+    subcommands:
+      view:
+        classification: READONLY
+        strict: false
+      get-contexts:
+        classification: READONLY
+        strict: false
+      current-context:
+        classification: READONLY
+        strict: false
+      use-context:
+        classification: EXTERNAL_EFFECTS
+      set:
+        classification: EXTERNAL_EFFECTS
+      set-context:
+        classification: EXTERNAL_EFFECTS
+      set-cluster:
+        classification: EXTERNAL_EFFECTS
+      set-credentials:
+        classification: EXTERNAL_EFFECTS
+      delete-context:
+        classification: DANGEROUS
+      delete-cluster:
+        classification: DANGEROUS
+
+  diff:
+    classification: READONLY
+    strict: false
+
+  kustomize:
+    classification: READONLY
+    strict: false
+
+  events:
+    classification: READONLY
+    strict: false
+
+  wait:
+    classification: READONLY
+    strict: false

data/lib/rubik/security/classifier/commands/less.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: less
+description: "View file contents with backward movement"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/ln.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: ln
+description: "Make links between files"
+classification: LOCAL_EFFECTS
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/ls.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: ls
+description: "List directory contents"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/make.yaml

@@ -0,0 +1,21 @@
+# $schema: ../../../schemas/command.schema.json
+command: make
+description: "Build automation tool"
+classification: LOCAL_EFFECTS
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+options:
+  -C: {takes_value: true, captures_directory: true}
+  --directory: {takes_value: true, captures_directory: true, aliases: [-C]}
+  -f: {takes_value: true}
+  --file: {takes_value: true, aliases: [-f]}
+  -j: {takes_value: true}
+  --jobs: {takes_value: true, aliases: [-j]}
+  -n: {overrides: READONLY}
+  --just-print: {overrides: READONLY, aliases: [-n]}
+  --dry-run: {overrides: READONLY, aliases: [-n]}
+  -k: {}
+  --keep-going: {}
+  -B: {}
+  --always-make: {}

data/lib/rubik/security/classifier/commands/md5sum.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: md5sum
+description: "Compute and check MD5 message digest"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}