# ---------------------------------------------------------------------------
# Overview of the default fapolicyd-filter.conf
#
# Decision flow
#   1.  Rules are read top-to-bottom.  Leading “+” means the path is
#       considered essential and will be added to the trust database;
#       leading “-” means the path is skipped.
#   2.  Indentation creates a parent-child relationship.  A child rule
#       refines the decision of its parent.  Think “allow everything
#       under /usr/, then deny one sub-tree, then allow one file type
#       back in”, etc.
#   3.  If no rule matches at the end of the scan, the parent’s decision
#       stands; the very last top-level rule is therefore the catch-all.
#
# What the shipped rules do
#   • Start with “+ /”             → everything allowed by default.
#   • Deny /usr/include/ entirely.                      (- usr/include/)
#   • Deny /usr/share/ but re-allow developer artefacts:
#         *.py  *.pl  etc
#   • Deny /usr/src/kernel*/       except:
#         */scripts/*   and   */tools/objtool/*
#   • Deny html, md, conf, and other non-executable files
#
# For full syntax see:  man 5 fapolicyd-filter.conf
# ---------------------------------------------------------------------------

+ /
 - usr/include/
 - usr/share/
  # Python byte code
  + *.py?
  # Python text files
  + *.py
  # Some apps have a private bin
  + */bin/*
  # Some apps have a private libexec
  + */libexec/*
  # Ruby
  + *.rb
  # Perl
  + *.pl
  # System tap
  + *.stp
  # Javascript
  + *.js
  # Java archive
  + *.jar
  # M4
  + *.m4
  # PHP
  + *.php
  # Perl Modules
  + *.pm
  # Lua
  + *.lua
  # Java
  + *.class
  # Typescript
  + *.ts
  # Typescript JSX
  + *.tsx
  # Lisp
  + *.el
  # Compiled Lisp
  + *.elc
  # Allow Lmod to run in bash profiles.d/modules.sh
  + lmod/*/bash
 # Drop all source (kernel/nvidia)
 - usr/src/*/
  # Allow scripts and tools
  + */scripts/*
   # Drop any source code
   - *.c
   - *.h
  + */tools/objtool/*
 # Drop any xz 
 - *.xz
 # Drop any html
 - *.html
 # Drop any json
 - *.json
 # Drop any markdown
 - *.md
 # Drop any configuration
 - *.conf
 # drop png files scattered all over
 - *.png
