tl;dr with Uzzar, you can't rm -rf /, dd if=/dev/zero of=/dev/, mkfs, chmod -R 777 /, chown -R, find / -delete, shutdown, reboot, or kill -9 -1

the real flex here was testing this tool to see that is works. good luck!🤘

uzzar

uzzar is a command wrapper installer that intercepts high-risk binaries and blocks policy-matched commands. You can't run rm -rf /, rm -rf /*, --no-preserve-root, dd if=/dev/zero of=/dev/, dd if=/dev/random of=/dev/, mkfs, chmod -R 777 /, chown -R, find / -delete, shutdown, reboot, or kill -9 -1 with uzzar enabled.

What Gets Wrapped

uzzar install attempts to wrap these binaries when present:

• rm
• dd
• chmod
• chown
• mv
• find
• shutdown
• reboot
• kill
• ln
• mkfs

Enforcement Scope

npm i -g uzzar only installs the CLI package. Actual command interception starts after sudo uzzar install, which replaces target binaries with wrappers.

Install

npm i -g uzzar
sudo uzzar install

Expected outcome:

• /usr/local/uzzar is created
• a backup of each wrapped binary is stored under /usr/local/uzzar/original
• wrapper scripts are placed at original binary paths
• a manifest is written to /usr/local/uzzar/install-manifest.json

Uninstall

sudo uzzar uninstall

Expected outcome:

• each wrapped binary is restored from manifest-backed backups
• /usr/local/uzzar is removed

Policy

Default policy file:

/usr/local/uzzar/policy.json

Default bundled policy template:

assets/policy.json

Policy contract:

• JSON object with blockPatterns as string[]
• matching is case-insensitive normalized command matching with * wildcard support

Example:

{
  "blockPatterns": [
    "rm -rf /",
    "--no-preserve-root",
    "mkfs"
  ]
}

Hardening Behavior

uzzar applies best-effort immutable flags during install:

• macOS: chflags uchg
• Linux: chattr +i

And removes flags during uninstall:

• macOS: chflags nouchg
• Linux: chattr -i

If immutable tooling is unavailable, installation still proceeds.

Recovery Scenarios

Command blocked unexpectedly

Check:

cat /usr/local/uzzar/policy.json

Recovery:

1. Remove or adjust the matching blockPatterns entry.
2. Re-run the command.

Missing guard runtime or policy file

Symptoms:

• wrapper prints uzzar guard runtime missing or uzzar policy file missing.

Recovery:

1. Reinstall:

   sudo uzzar uninstall
   sudo uzzar install

Partial uninstall due missing backup

Symptoms:

• uninstall logs Skipping restore, backup missing: ...

Recovery:

1. Restore that binary manually from OS package manager or trusted backup.
2. Re-run sudo uzzar uninstall.

Development

Build:

pnpm run build

Test:

pnpm run test

Tests use a fake system root and do not modify host /bin paths.

Optional Shell Hook

For shell-level patterns that are not binary invocations, add a shell hook:

preexec() {
  case "$1" in
    ":(){ :|:& };:"|\
    *"> /etc/passwd"*|\
    *"> ~/.ssh/authorized_keys"*)
      echo "uzzar blocked this"
      return 1
    ;;
  esac
}

Enterprise Path

For non-bypassable enforcement on managed fleets:

• macOS: EndpointSecurity system extension (ES_EVENT_TYPE_AUTH_EXEC)
• Linux: SELinux, AppArmor, or eBPF-based exec policy

Detailed blocked-command examples:

• docs/commands/README.md