Intermediate
Open
Free
The One-Character Difference That Changes What a Rule Matches
You write Bash(git diff*) in permissions.allow, intending it to
match git diff and its variants. A teammate points out it also
silently matches git diff-index.
What's the actual fix?
Solution
The correct answer is "Add a space before the asterisk: Bash(git diff *)."
The trailing * (with a space) is prefix matching on the full
command, one token at a time — Bash(git diff*) fuses the asterisk
onto the word itself and also matches unrelated commands like git diff-index. Escaping the asterisk changes the matching semantics
entirely rather than fixing the intent, dropping the wildcard would
stop it from matching git diff with any arguments at all, and
moving the rule to deny inverts the intent rather than fixing the
pattern.
Share this question