Action reference

This file is generated. Do not edit by hand. Regenerate with UPDATE_ACTION_REFERENCE=1 cargo test -p sysknife-daemon --test action_reference_doc; a plain cargo test fails if it drifts from the catalogue.

Every row is derived from the live code: the command from each action's ActionSpec mechanism, the risk from its risk_level, the distro from sysknife-core::action_family, and the description from the brain's KNOWN_ACTIONS list. Distro is All (cross-distro), Ubuntu (Debian-family only), or Fedora (atomic-host only). Rb = requires reboot; Ro = automatic rollback available.

Deployment (atomic host)

Action	Command	Risk	Distro	Rb	Ro	Description
`GetSystemState`	`rpm-ostree status --json`	Low	Fedora	–	–	full rpm-ostree deployment snapshot: layered packages, pinned/staged deployments, booted/pending OSTree refs — Fedora/atomic only; on Ubuntu use GetHostState
`CollectDiagnostics`	`journalctl -b -n 500 --no-pager`	Low	All	–	–	recent system journal log (last 500 lines) for error diagnosis and troubleshooting
`GetDeploymentHistory`	`rpm-ostree status --json`	Low	Fedora	–	–	rpm-ostree deployment history: past and current OSTree commits with timestamps
`ListDeployments`	`rpm-ostree status --json`	Low	Fedora	–	–	list all currently staged, pending, and booted deployments
`UpdateSystem`	`sudo rpm-ostree upgrade`	High	Fedora	✓	✓	download and stage the latest OSTree update (does not reboot)
`PinDeployment`	`sudo ostree admin pin 0`	High	Fedora	–	–	pin a deployment so it is not GC'd — param: index (u32, deployment index from ListDeployments)
`UnpinDeployment`	`sudo ostree admin pin --unpin 0`	High	Fedora	–	–	unpin a previously pinned deployment — param: index (u32)
`RebaseSystem`	`sudo rpm-ostree rebase fedora/41/x86_64/silverblue`	High	Fedora	✓	✓	switch to a different OSTree ref/remote — param: target_ref (string, e.g. fedora/40/x86_64/silverblue)
`CleanupDeployments`	`sudo rpm-ostree cleanup --rollback --pending`	High	Fedora	–	–	remove old staged deployments to free disk space
`RebootSystem`	`sudo systemctl reboot`	High	All	✓	–	reboot the machine into the current or staged deployment
`RollbackDeployment`	`sudo rpm-ostree rollback`	High	Fedora	✓	–	roll back to the previous booted deployment
`GetKernelArguments`	`rpm-ostree kargs`	Low	Fedora	–	–	list current kernel command-line arguments (kargs)
`SetKernelArguments`	`sudo rpm-ostree kargs`	High	Fedora	✓	✓	add/remove kernel command-line args — params: add (string[]), remove (string[]) — either may be []; both lists are screened: no weakening arg may be added, and no protective one (lockdown=, module.sig_enforce=1, pti=on, mitigations=, selinux=1, slab_nomerge, …) removed

Package layering (rpm-ostree)

Action	Command	Risk	Distro	Rb	Ro	Description
`InstallPackages`	`sudo rpm-ostree install --idempotent podman`	High	Fedora	✓	✓	layer multiple RPM packages — param: packages* (string[])
`RemovePackages`	`sudo rpm-ostree uninstall podman`	High	Fedora	✓	✓	remove layered RPM packages — param: packages* (string[])
`GetLayeredPackages`	`rpm-ostree status --json`	Low	Fedora	–	–	list RPM packages layered on top of the base OS image — no params
`AddLayeredPackage`	`sudo rpm-ostree install --idempotent podman`	High	Fedora	✓	✓	layer a single RPM package (requires reboot) — param: package* (string)
`RemoveLayeredPackage`	`sudo rpm-ostree uninstall podman`	High	Fedora	✓	✓	remove a single layered RPM package (requires reboot) — param: package* (string)
`ReplaceLayeredPackage`	`sudo rpm-ostree install neovim --uninstall vim`	High	Fedora	✓	✓	replace one layered package with another — params: old* (string), new* (string)
`ResetLayeredPackageOverride`	`sudo rpm-ostree override reset --all`	High	Fedora	✓	✓	reset all rpm-ostree override changes — no params
`RemoveBasePackage`	`sudo rpm-ostree override remove gedit`	High	Fedora	✓	✓	exclude a base OS package from the deployment — param: package* (string)
`GetPendingUpdates`	`rpm-ostree upgrade --check`	Low	Fedora	–	–	check for a staged update and show its diff — no params

Filesystem

Action	Command	Risk	Distro	Rb	Ro	Description
`GetDiskUsage`	`df -h --output=source,fstype,size,used,avail,pcent,target --exclude-type=composefs --exclude-type=tmpfs --exclude-type=devtmpfs --exclude-type=efivarfs`	Low	All	–	–	show disk space usage for all mounted filesystems (df -h) — no params

Flatpak

Action	Command	Risk	Distro	Rb	Ro	Description
`InstallFlatpak`	`sudo runuser -u testuser -- flatpak install --user -y flathub app-id`	Medium	All	–	–	install a Flatpak app — params: username* (Linux user), app_id* (e.g. org.mozilla.firefox), remote* (e.g. flathub)
`RemoveFlatpak`	`sudo runuser -u testuser -- flatpak uninstall --user -y app-id`	Medium	All	–	–	uninstall a Flatpak app — params: username, app_id
`SearchFlatpakApps`	`flatpak search search-term`	Low	All	–	–	search Flatpak remotes for apps — param: term* (query string) — no username needed
`ListFlatpakRemotes`	`sudo runuser -u testuser -- flatpak remotes --user --columns=name,url`	Low	All	–	–	list configured Flatpak remotes — param: username*
`ListInstalledFlatpaks`	`sudo runuser -u testuser -- flatpak list --user --app --columns=application,name,version,origin`	Low	All	–	–	list installed Flatpak apps for a user — param: username*
`AddFlatpakRemote`	`sudo runuser -u testuser -- flatpak remote-add --user --if-not-exists remote https://example.invalid`	Medium	All	–	–	add a Flatpak remote — params: username, remote (name), url*
`RemoveFlatpakRemote`	`sudo runuser -u testuser -- flatpak remote-delete --user remote`	Medium	All	–	–	remove a Flatpak remote — params: username, remote (name)
`GetFlatpakAppInfo`	`sudo runuser -u testuser -- flatpak info --user app-id`	Low	All	–	–	show metadata for an installed Flatpak — params: username, app_id
`UpdateFlatpak`	`sudo runuser -u testuser -- flatpak update --user -y com.example.App`	Medium	All	–	–	update Flatpak apps — params: username* (required); app_id (optional — omit to update all)
`UbuntuInstallFlatpak`	`sudo runuser -u testuser -- flatpak install --user -y flathub app-id`	Medium	Ubuntu	–	–	install a Flatpak app on Ubuntu — params: username, app_id, remote* (e.g. flathub); Ubuntu only; Medium risk
`UbuntuRemoveFlatpak`	`sudo runuser -u testuser -- flatpak uninstall --user -y app-id`	Medium	Ubuntu	–	–	remove a Flatpak app on Ubuntu — params: username, app_id; Ubuntu only; Medium risk
`UbuntuUpdateFlatpak`	`sudo runuser -u testuser -- flatpak update --user -y com.example.App`	Medium	Ubuntu	–	–	update Flatpak app(s) on Ubuntu — param: username*; optional: app_id (omit for all); Ubuntu only; Medium risk
`UbuntuListFlatpaks`	`sudo runuser -u testuser -- flatpak list --user --app --columns=application,name,version,origin`	Low	Ubuntu	–	–	list installed Flatpak apps on Ubuntu — param: username*; Ubuntu only; read-only

Toolbox

Action	Command	Risk	Distro	Rb	Ro	Description
`ListToolboxes`	`sudo runuser -l testuser -c "XDG_RUNTIME_DIR=/run/user/$(id -u) toolbox list"`	Low	All	–	–	list toolbox containers for a user — param: username*
`CreateToolbox`	`sudo runuser -l testuser -c "XDG_RUNTIME_DIR=/run/user/$(id -u) toolbox create --container 'sysknife-dev' --release '41'"`	Medium	All	–	–	create a toolbox container — params: username, name; optional: image, release
`RemoveToolbox`	`sudo runuser -l testuser -c "XDG_RUNTIME_DIR=/run/user/$(id -u) toolbox rm 'sysknife-dev'"`	Medium	All	–	–	remove a toolbox container — params: username, name

Services

Action	Command	Risk	Distro	Rb	Ro	Description
`ListServices`	`systemctl list-units --type=service --all --no-legend --no-pager`	Low	All	–	–	list all systemd units and their active/enabled state — no params
`StartService`	`sudo systemctl start NetworkManager.service`	Medium	All	–	–	start a systemd service — param: unit* (e.g. sshd.service)
`StopService`	`sudo systemctl stop NetworkManager.service`	Medium	All	–	–	stop a systemd service — param: unit*
`RestartService`	`sudo systemctl restart NetworkManager.service`	Medium	All	–	–	restart a systemd service — param: unit*
`SetServiceEnabled`	`sudo systemctl enable sshd.service`	Medium	All	–	–	enable or disable a service at boot — params: unit, enabled (bool)
`MaskService`	`sudo systemctl mask cups.service`	High	All	–	–	mask a unit so it cannot start by any means — param: unit*
`UnmaskService`	`sudo systemctl unmask cups.service`	Medium	All	–	–	unmask a previously masked unit — param: unit*
`GetServiceLogs`	`journalctl -u NetworkManager.service -n 200 --no-pager`	Low	All	–	–	fetch recent journald log lines for a service — param: unit*
`GetServiceStatus`	`systemctl status nginx.service --no-pager`	Low	All	–	–	show detailed status of a service — param: unit*
`ReloadService`	`sudo systemctl reload nginx.service`	Medium	All	–	–	reload a service config without restart (SIGHUP) — param: unit*
`ListTimers`	`systemctl list-timers --all --no-legend --no-pager`	Low	All	–	–	list all systemd timer units with next trigger time — no params
`ReloadDaemon`	`sudo systemctl daemon-reload`	Medium	All	–	–	run systemctl daemon-reload to pick up changed unit files — no params
`CreateScheduledJob`	`sudo /usr/lib/sysknife/scheduled-job-edit --name sysknife-example --command /usr/bin/true --schedule "--* 02:00:00"`	High	All	–	–	schedule a recurring command as a systemd timer — params: name* (unit-safe id), command* (executable line), schedule* (systemd OnCalendar, e.g. "--* 02:00:00" or "daily")
`GetServiceResourceLimits`	`systemctl show nginx.service --property=MemoryMax,MemoryHigh,CPUQuotaPerSecUSec,TasksMax`	Low	All	–	–	show a service's cgroup limits (MemoryMax/CPUQuota/TasksMax) via systemctl show — param: unit*; read-only
`SetServiceResourceLimits`	`sudo systemctl set-property nginx.service MemoryMax=500M CPUQuota=50%`	Medium	All	–	–	cap a service's resources via systemctl set-property (applies live + persists) — params: unit*, plus at least one of memory_max (e.g. '500M' or 'infinity'), memory_high, cpu_quota (e.g. '50%'), tasks_max (integer or 'infinity'); Medium risk; undo with systemctl revert

Processes

Action	Command	Risk	Distro	Rb	Ro	Description
`ListProcesses`	`ps aux --sort=-%mem`	Low	All	–	–	list running processes with CPU and memory usage — no params
`SignalProcess`	`sudo kill -s TERM 1234`	High	All	–	–	send a signal to a process to stop it — params: pid* (integer > 1); signal (TERM\|KILL\|HUP\|INT, default TERM)

Journald

Action	Command	Risk	Distro	Rb	Ro	Description
`GetJournalLog`	`journalctl --output=json --no-pager --lines=100 --unit=ssh.service --priority=err --boot`	Low	All	–	–	read filtered systemd journal entries as JSON (journalctl) — all params optional: unit (e.g. 'ssh.service'), priority (0-7 or name like 'err', or a range '0..3'), boot (bool, current boot only), kernel (bool, kernel messages only), since/until (e.g. '2026-07-22 10:00:00', 'yesterday', '-1h'), grep (regex on MESSAGE), lines (default 100, max 10000); read-only
`VacuumJournal`	`journalctl --vacuum-size=500M`	High	All	–	–	reclaim journal disk space — supply exactly one of size_mb (cap total journal size) or retain_days (delete entries older than N days)

Storage — LVM

Action	Command	Risk	Distro	Rb	Ro	Description
`GetLvmReport`	`lvs --reportformat json --units b -o lv_name,vg_name,lv_size,lv_attr,origin,data_percent`	Low	All	–	–	list logical volumes with VG, size, attributes, and usage as JSON (lvs) — no params; read-only
`ExtendLogicalVolume`	`sudo lvextend -L +10G -r ubuntu-vg/ubuntu-lv`	High	All	–	–	grow a logical volume AND its filesystem in one step (lvextend -r) — params: vg, lv, size* (e.g. '+10G' to add, or '50G' absolute); High risk
`CreateLogicalVolume`	`sudo lvcreate -L 20G -n data ubuntu-vg`	Medium	All	–	–	create a new logical volume in a volume group (lvcreate) — params: vg, name, size* (e.g. '20G'); Medium risk
`CreateLvSnapshot`	`sudo lvcreate -s -L 5G -n ubuntu-lv-snap ubuntu-vg/ubuntu-lv`	Medium	All	–	–	snapshot a logical volume before risky changes (lvcreate -s) — params: vg, origin (LV to snapshot), snapshot* (new name), size* (copy-on-write reserve, e.g. '5G'); Medium risk

Kernel parameters — sysctl

Action	Command	Risk	Distro	Rb	Ro	Description
`GetSysctl`	`sysctl -- net.ipv4.ip_forward`	Low	All	–	–	read a kernel parameter (sysctl) — param: key (optional, dotted e.g. 'net.ipv4.ip_forward'; omit to dump all); read-only
`SetSysctl`	`sudo /usr/lib/sysknife/sysctl-edit --key net.ipv4.ip_forward --value 1`	High	All	–	–	set AND persist a kernel parameter (runtime + /etc/sysctl.d drop-in) — params: key* (dotted, e.g. 'vm.swappiness'), value* (number or space-separated list); High risk

Mounts & swap

Action	Command	Risk	Distro	Rb	Ro	Description
`GetMounts`	`findmnt --json`	Low	All	–	–	list mounted filesystems as JSON (findmnt) — no params; read-only
`AddMount`	`sudo /usr/lib/sysknife/mount-edit --op mount --device /dev/sdb1 --mountpoint /mnt/data --fstype ext4 --options defaults`	High	All	–	–	mount a device and persist it to /etc/fstab with nofail — params: device* (/dev/.., UUID=.., LABEL=.., //host/share, or host:/export), mountpoint* (absolute; not a system dir), fstype* (ext4/xfs/btrfs/vfat/nfs/cifs/…), options (csv, optional); High risk
`RemoveMount`	`sudo /usr/lib/sysknife/mount-edit --op unmount --mountpoint /mnt/data`	High	All	–	–	unmount and drop the /etc/fstab entry for a mountpoint — param: mountpoint*; High risk
`AddSwap`	`sudo /usr/lib/sysknife/mount-edit --op addswap --file /swapfile --size-mb 2048`	High	All	–	–	create a swap file, enable it, and persist to /etc/fstab — params: file* (absolute path), size_mb* (integer MB); High risk
`RemoveSwap`	`sudo /usr/lib/sysknife/mount-edit --op rmswap --file /swapfile`	High	All	–	–	disable a swap file, remove it, and drop its /etc/fstab entry — param: file* (must already be a swap file per /proc/swaps or /etc/fstab, and not a symlink); High risk

Log management

Action	Command	Risk	Distro	Rb	Ro	Description
`GetLogrotateStatus`	`logrotate -d /etc/logrotate.conf`	Low	All	–	–	dry-run logrotate to show what would rotate (logrotate -d) — param: config (optional path); read-only
`ConfigureLogRotation`	`sudo /usr/lib/sysknife/log-edit --op logrotate --name nginx --path /var/log/nginx/*.log --frequency daily --rotate 14 --compress`	Medium	All	–	–	write a logrotate drop-in (validated with logrotate -d) — params: name, path (log file/glob under /var/log), frequency* (daily\|weekly\|monthly), rotate* (count 0-1000), compress (bool); Medium risk
`RemoveLogRotation`	`sudo /usr/lib/sysknife/log-edit --op rm-logrotate --name nginx`	Medium	All	–	–	remove a SysKnife-managed logrotate drop-in — param: name*; Medium risk
`ConfigureRemoteSyslog`	`sudo /usr/lib/sysknife/log-edit --op rsyslog-forward --host logs.example.com --port 514 --protocol tcp`	High	All	–	–	forward all logs to a remote collector via rsyslog (validated with rsyslogd -N1) — params: host, port (1-65535), protocol* (tcp\|udp); High risk — logs leave the host
`RemoveRemoteSyslog`	`sudo /usr/lib/sysknife/log-edit --op rm-forward`	High	All	–	–	stop remote syslog forwarding (remove the rsyslog drop-in) — no params; High risk

PAM password policy

Action	Command	Risk	Distro	Rb	Ro	Description
`GetPasswordAging`	`chage -l alice`	Low	All	–	–	show a user's password-aging fields (chage -l) — param: user*; read-only
`SetPasswordAging`	`sudo chage -M 90 alice`	High	All	–	–	set a user's password aging (chage) — params: user*, plus at least one of max_days/min_days/warn_days (0-99999); High risk
`SetPasswordPolicy`	`sudo /usr/lib/sysknife/pam-edit --op pwquality --minlen 12`	High	All	–	–	set password-quality rules via pwquality — params: at least one of minlen (1-128), dcredit/ucredit/lcredit/ocredit (-64..64); High risk — needs libpam-pwquality enabled in the PAM stack to take effect
`SetAccountLockout`	`sudo /usr/lib/sysknife/pam-edit --op faillock --deny 5`	High	All	–	–	configure account lockout via faillock — params: at least one of deny (1-1000), unlock_time/fail_interval (seconds, 0-604800); High risk — needs pam_faillock enabled in the PAM stack to take effect

auditd

Action	Command	Risk	Distro	Rb	Ro	Description
`GetAuditRules`	`auditctl -l`	Low	All	–	–	list loaded audit rules (auditctl -l) — no params; read-only; needs auditd installed
`AddAuditRule`	`sudo /usr/lib/sysknife/audit-edit --op add --path /etc/passwd --perms wa --key passwd-watch`	Medium	All	–	–	add a persistent audit file-watch rule — params: path* (absolute file/dir), perms* (subset of r/w/x/a), key* (label); Medium risk; needs auditd installed
`RemoveAuditRule`	`sudo /usr/lib/sysknife/audit-edit --op remove --key passwd-watch`	High	All	–	–	remove a SysKnife-managed audit rule by key — param: key*; High risk

certbot / ACME

Action	Command	Risk	Distro	Rb	Ro	Description
`GetCertificates`	`certbot certificates`	Low	All	–	–	list certbot-managed certificates — no params; read-only; needs certbot installed
`ObtainCertificate`	`sudo certbot certonly --non-interactive --agree-tos --standalone -m admin@example.com -d example.com`	High	All	–	–	obtain a TLS certificate non-interactively (certbot certonly) — params: domains* (array) or domain* (string), email*, challenge (standalone\|nginx\|apache, default standalone); High risk; needs certbot + network
`RenewCertificates`	`sudo certbot renew`	Medium	All	–	–	renew due certbot certificates (certbot renew) — no params; Medium risk; needs certbot + network

Scoped sudoers.d

Action	Command	Risk	Distro	Rb	Ro	Description
`GetSudoGrants`	`/usr/lib/sysknife/sudoers-edit --op list`	Low	All	–	–	list SysKnife-managed sudoers.d drop-ins — no params; read-only
`GrantSudoAccess`	`sudo /usr/lib/sysknife/sudoers-edit --op grant --name deploy-restart --user deploy --commands /usr/bin/systemctl --nopasswd`	High	All	–	–	grant a scoped sudo rule (validated with visudo before install) — params: name* (^[a-z0-9][a-z0-9_-]$), user, commands* ('ALL' or comma-separated ABSOLUTE paths), runas (default root, or 'ALL'), nopasswd (bool); High risk — this configures privilege escalation
`RevokeSudoAccess`	`sudo /usr/lib/sysknife/sudoers-edit --op revoke --name deploy-restart`	High	All	–	–	remove a SysKnife-managed sudoers.d drop-in — param: name*; High risk

Network

Action	Command	Risk	Distro	Rb	Ro	Description
`ConfigureWifi`	`sudo nmcli device wifi connect CafeHotspot`	High	All	–	–	connect to a Wi-Fi network — params: ssid*, password (optional for open networks)
`SetDnsServers`	`sudo resolvectl dns wlp1s0 1.1.1.1 8.8.8.8`	High	All	–	–	set DNS servers for an interface — params: interface* (e.g. wlp1s0), servers* (string[])
`ConfigureFirewall`	`sudo sh -c "firewall-cmd --permanent --zone='public' --add-service='ssh' && firewall-cmd --reload"`	High	All	–	–	add/remove a service in a firewalld zone — params: zone, service, enabled* (bool)
`GetFirewallState`	`firewall-cmd --list-all`	Low	All	–	–	show current firewalld zones, open services, and port rules — no params
`GetNetworkStatus`	`ip -brief addr`	Low	All	–	–	show LIVE network state: interfaces, IP addresses, and connection state — no params; this is runtime status, NOT the saved configuration; on Ubuntu the saved config is NetplanGetConfig
`GetListeningPorts`	`ss -tulpnH`	Low	All	–	–	show listening TCP/UDP sockets and the process bound to each (ss -tulpn) — no params; read-only; use for "what is listening on port X?"

resolvectl

Action	Command	Risk	Distro	Rb	Ro	Description
`ResolvectlStatus`	`resolvectl status`	Low	All	–	–	show DNS resolution status for all network interfaces (resolvectl status) — no params; cross-distro (any systemd-resolved host); read-only
`ResolvectlSetDns`	`sudo resolvectl dns eth0 1.1.1.1 8.8.8.8`	High	All	–	–	set DNS servers for a network interface — params: interface* (e.g. eth0), servers* (string[]); cross-distro; High risk

Identity / time / locale

Action	Command	Risk	Distro	Rb	Ro	Description
`GetDateTime`	`timedatectl`	Low	All	–	–	current date, time, timezone, and NTP status (timedatectl) — no params
`SetHostname`	`sudo hostnamectl set-hostname sysknife-lab`	Medium	All	–	–	change the system hostname — param: hostname* (string)
`SetTimezone`	`sudo timedatectl set-timezone America/Mexico_City`	Medium	All	–	–	change the system timezone — param: timezone* (e.g. America/Chicago)
`SetLocale`	`sudo localectl set-locale en_US.UTF-8`	Medium	All	–	–	change the system locale — param: locale* (e.g. en_US.UTF-8)
`SetNtp`	`sudo timedatectl set-ntp true`	Medium	All	–	–	enable or disable NTP sync — param: enabled* (bool)

Users & groups

Action	Command	Risk	Distro	Rb	Ro	Description
`ListUsers`	`getent passwd`	Low	All	–	–	list all local user accounts — no params
`ListGroups`	`getent group`	Low	All	–	–	list all local groups — no params
`CreateUser`	`sudo useradd --create-home --home-dir /home/alice --shell /bin/bash alice`	High	All	–	–	create a local user account — param: username*; optional: shell, home
`DeleteUser`	`sudo userdel alice`	High	All	–	–	delete a local user account — param: username*
`AddUserToGroup`	`sudo sh -c "grep -q '^wheel:' /etc/group \|\| getent group 'wheel' >> /etc/group; usermod --append --groups 'wheel' 'alice'"`	High	All	–	–	add a user to a group — params: username, group
`RemoveUserFromGroup`	`sudo sh -c "grep -q '^wheel:' /etc/group \|\| getent group 'wheel' >> /etc/group; gpasswd --delete 'alice' 'wheel'"`	High	All	–	–	remove a user from a group — params: username, group
`CreateGroup`	`sudo groupadd developers`	Medium	All	–	–	create a local group — param: group*; optional: system (bool → system GID range)
`DeleteGroup`	`sudo groupdel developers`	High	All	–	–	delete a local group — param: group*; irreversible
`LockUserAccount`	`sudo usermod --lock alice`	High	All	–	–	disable password login for a user without deleting it — param: username*
`UnlockUserAccount`	`sudo usermod --unlock alice`	High	All	–	–	re-enable password login for a locked user — param: username*

SSH keys

Action	Command	Risk	Distro	Rb	Ro	Description
`GetAuthorizedKeys`	`cat /home/alice/.ssh/authorized_keys`	Low	All	–	–	list SSH authorized_keys for a user — param: username*
`AddAuthorizedKey`	`sudo runuser -u alice -- sh -c "key=$1; path=$2; grep -Fxq -- \\"$key\\" \\"$path\\" 2>/dev/null \|\| printf '%s\\n' \\"$key\\" >> \\"$path\\"" sh "ssh-ed25519 AAAA..." /home/alice/.ssh/authorized_keys`	High	All	–	–	append an SSH public key to a user's authorized_keys — params: username, public_key (full key string)
`RemoveAuthorizedKey`	`sudo runuser -u alice -- sh -c "key=$1; path=$2; tmp=$(mktemp) \|\| exit 1; grep -Fxv -- \\"$key\\" \\"$path\\" > \\"$tmp\\"; rc=$?; if [ $rc -gt 1 ]; then rm -f \\"$tmp\\"; exit $rc; fi; cat \\"$tmp\\" > \\"$path\\"; rm -f \\"$tmp\\"" sh "ssh-ed25519 AAAA..." /home/alice/.ssh/authorized_keys`	High	All	–	–	remove an SSH public key from a user's authorized_keys — params: username, public_key (full key string)
`SetSshdOption`	`sudo /usr/lib/sysknife/sshd-option-edit --option PermitRootLogin --value prohibit-password`	High	All	–	–	harden sshd by setting an allowlisted option via a validated drop-in — params: option* (one of PermitRootLogin, PasswordAuthentication, PubkeyAuthentication, X11Forwarding, PermitEmptyPasswords), value* (per-option: yes/no, or prohibit-password/forced-commands-only for PermitRootLogin)

Package repositories

Action	Command	Risk	Distro	Rb	Ro	Description
`ListPackageRepositories`	scan `/etc/yum.repos.d`	Low	Fedora	–	–	list configured DNF/rpm-ostree repos and their enabled state — no params
`AddPackageRepository`	write `/etc/yum.repos.d/repo-id.repo`	High	Fedora	–	–	add a DNF repo — params: repo_id, repo_url
`RemovePackageRepository`	delete `/etc/yum.repos.d/repo-id.repo`	Medium	Fedora	–	–	remove a DNF repo — param: repo_id*
`EnablePackageRepository`	patch `/etc/yum.repos.d/repo-id.repo`	Medium	Fedora	–	–	enable a disabled DNF repo — param: repo_id*
`DisablePackageRepository`	patch `/etc/yum.repos.d/repo-id.repo`	Medium	Fedora	–	–	disable a DNF repo without removing it — param: repo_id*

System info

Action	Command	Risk	Distro	Rb	Ro	Description
`GetMemoryInfo`	`free -h`	Low	All	–	–	show RAM and swap usage (free -h) — no params
`GetHostState`	`hostnamectl status`	Low	Ubuntu	–	–	what this host is: OS release, kernel, architecture, virtualization, machine identity (hostnamectl) — Ubuntu/Debian counterpart to GetSystemState, which reports deployments an apt host does not have

Containers

Action	Command	Risk	Distro	Rb	Ro	Description
`ListContainers`	`sudo runuser -l testuser -c "podman ps --all --format json"`	Low	All	–	–	list Podman containers for a user — param: username*
`CreateContainer`	`sudo runuser -l testuser -c "podman create --name 'sysknife-dev' 'registry.fedoraproject.org/fedora-toolbox:41'"`	Medium	All	–	–	create a Podman container — params: username, name, image* (e.g. ubuntu:22.04)
`StartContainer`	`sudo runuser -l testuser -c "podman start 'sysknife-dev'"`	Medium	All	–	–	start a Podman container — params: username, name
`StopContainer`	`sudo runuser -l testuser -c "podman stop 'sysknife-dev'"`	Medium	All	–	–	stop a Podman container — params: username, name
`RemoveContainer`	`sudo runuser -l testuser -c "podman rm 'sysknife-dev'"`	Medium	All	–	–	remove a stopped Podman container — params: username, name
`GetContainerInfo`	`sudo runuser -l testuser -c "podman inspect 'sysknife-dev'"`	Low	All	–	–	inspect a Podman container — params: username, name

Reboot

Action	Command	Risk	Distro	Rb	Ro	Description
`CheckPendingReboot`	`bash -c "if test -f /var/run/reboot-required; then cat /var/run/reboot-required; cat /var/run/reboot-required.pkgs 2>/dev/null; true; else echo 'No reboot required.'; fi"`	Low	Ubuntu	–	–	check whether a reboot is pending (/var/run/reboot-required) — no params; Ubuntu/Debian only; read-only

AppArmor

Action	Command	Risk	Distro	Rb	Ro	Description
`AppArmorStatus`	`sudo aa-status`	Low	Ubuntu	–	–	show status of all loaded AppArmor profiles (aa-status) — no params; Ubuntu only; read-only
`AppArmorEnforce`	`sudo aa-enforce /etc/apparmor.d/usr.bin.firefox`	High	Ubuntu	–	–	put an AppArmor profile into enforce mode (aa-enforce) — param: profile_path* (e.g. /etc/apparmor.d/usr.bin.firefox); Ubuntu only; High risk
`AppArmorComplain`	`sudo aa-complain /etc/apparmor.d/usr.bin.firefox`	High	Ubuntu	–	–	put an AppArmor profile into complain/learning mode (aa-complain) — param: profile_path*; Ubuntu only; High risk (disables MAC enforcement for the profile)

cloud-init

Action	Command	Risk	Distro	Rb	Ro	Description
`CloudInitStatus`	`cloud-init status --long`	Low	Ubuntu	–	–	show cloud-init provisioning status (cloud-init status --long) — no params; Ubuntu only; read-only

fail2ban

Action	Command	Risk	Distro	Rb	Ro	Description
`Fail2banStatus`	`sudo fail2ban-client status`	Low	Ubuntu	–	–	show fail2ban jail status — optional param: jail (omit for all jails); Ubuntu only; read-only
`Fail2banBanIp`	`sudo fail2ban-client set sshd banip 192.0.2.1`	High	Ubuntu	–	–	ban an IP address in a fail2ban jail — params: jail* (string), ip* (IPv4 or IPv6); Ubuntu only; High risk
`Fail2banUnbanIp`	`sudo fail2ban-client set sshd unbanip 192.0.2.1`	Medium	Ubuntu	–	–	unban an IP address from a fail2ban jail — params: jail, ip; Ubuntu only; Medium risk
`ConfigureFail2banJail`	`sudo /usr/lib/sysknife/fail2ban-jail-edit --name sshd --maxretry 3`	High	Ubuntu	–	–	write a fail2ban jail override (/etc/fail2ban/jail.d/) — params: name*, plus at least one of enabled (bool), maxretry (1-100), bantime/findtime (seconds 0-2592000); Ubuntu only; High risk; needs fail2ban installed

apt

Action	Command	Risk	Distro	Rb	Ro	Description
`AptUpdate`	`sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a /usr/bin/apt-get update`	Low	Ubuntu	–	–	refresh apt package index (apt-get update) — no params; Ubuntu only
`AptUpgrade`	`sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a /usr/bin/apt-get dist-upgrade -y`	High	Ubuntu	–	–	upgrade all installed packages via dist-upgrade — no params; Ubuntu only; High risk
`AptInstall`	`sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a /usr/bin/apt-get install -y curl`	Medium	Ubuntu	–	–	install a package — param: package* (string, e.g. nginx); Ubuntu only
`AptRemove`	`sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a /usr/bin/apt-get remove -y curl`	Medium	Ubuntu	–	–	remove a package, keep config files — param: package*; Ubuntu only
`AptPurge`	`sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a /usr/bin/apt-get purge -y curl`	Medium	Ubuntu	–	–	remove a package AND its config files — param: package*; Ubuntu only
`AptAutoremove`	`sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a /usr/bin/apt-get autoremove -y`	Medium	Ubuntu	–	–	remove automatically-installed packages no longer needed — no params; Ubuntu only
`AptHold`	`sudo apt-mark hold curl`	Medium	Ubuntu	–	–	pin a package at its current version (apt-mark hold) — param: package*; Ubuntu only
`AptUnhold`	`sudo apt-mark unhold curl`	Medium	Ubuntu	–	–	unpin a package to allow upgrades (apt-mark unhold) — param: package*; Ubuntu only
`AptSearch`	`apt-cache search curl`	Low	Ubuntu	–	–	search apt repos for packages — param: term*; Ubuntu only; read-only
`AptListInstalled`	`dpkg -l`	Low	Ubuntu	–	–	list all installed packages (dpkg -l) — no params; Ubuntu only; read-only
`AptShow`	`apt-cache show curl`	Low	Ubuntu	–	–	show package details (version, deps, description) — param: package*; Ubuntu only; read-only
`AptListUpgradable`	`bash -c "apt list --upgradable 2>/dev/null"`	Low	Ubuntu	–	–	list packages with available upgrades — no params; Ubuntu only; read-only. Use for 'are there pending updates?' or 'what updates are available?'
`AptHistoryList`	`bash -c "grep -A 4 '^Start-Date' /var/log/apt/history.log \| tail -n 80"`	Low	Ubuntu	–	–	show recent apt transaction history — no params; Ubuntu only; read-only
`ConfigureUnattendedUpgrades`	`sudo /usr/lib/sysknife/unattended-upgrades-edit --enable`	High	Ubuntu	–	–	enable or disable automatic security updates (unattended-upgrades) — param: enabled* (bool); Ubuntu only; High risk

apt preferences / pinning

Action	Command	Risk	Distro	Rb	Ro	Description
`GetAptPins`	`apt-cache policy`	Low	Ubuntu	–	–	show apt pin priorities (apt-cache policy) — param: package (optional); Ubuntu only; read-only
`SetAptPin`	`sudo /usr/lib/sysknife/apt-pin-edit --op set --name hold-nginx --package nginx --pin "version 1.24.*" --priority 990`	Medium	Ubuntu	–	–	pin a package to a version/release via /etc/apt/preferences.d — params: name, package (glob), pin* (e.g. 'version 1.24.' or 'release a=noble-security'), priority (int -1..1000); Ubuntu only; Medium risk
`RemoveAptPin`	`sudo /usr/lib/sysknife/apt-pin-edit --op remove --name hold-nginx`	Medium	Ubuntu	–	–	remove a SysKnife-managed apt pin — param: name*; Ubuntu only; Medium risk

PPA

Action	Command	Risk	Distro	Rb	Ro	Description
`AddPpa`	`sudo add-apt-repository -y ppa:deadsnakes/ppa`	High	Ubuntu	–	–	add a Launchpad PPA — param: name* in <user>/<ppa> format (e.g. 'deadsnakes/ppa'); Ubuntu only; requires software-properties-common
`RemovePpa`	`sudo add-apt-repository -y --remove ppa:deadsnakes/ppa`	Medium	Ubuntu	–	–	remove a Launchpad PPA — param: name* in <user>/<ppa> format; Ubuntu only

snap

Action	Command	Risk	Distro	Rb	Ro	Description
`SnapInstall`	`sudo sh -c "snap install --channel=stable firefox && snap refresh --hold firefox"`	Medium	Ubuntu	–	–	install a snap (auto-holds to prevent auto-refresh) — params: name*; optional: channel (default stable), auto_update (bool, default false); Ubuntu only
`SnapRemove`	`sudo snap remove firefox`	Medium	Ubuntu	–	–	remove a snap — param: name*; Ubuntu only
`SnapRefresh`	`sudo snap refresh firefox`	Medium	Ubuntu	–	–	update a snap or all snaps — param: name (optional, omit for all); Ubuntu only
`SnapHold`	`sudo snap refresh --hold firefox`	Medium	Ubuntu	–	–	pin a snap at its current version (snap refresh --hold) — param: name*; Ubuntu only
`SnapUnhold`	`sudo snap refresh --unhold firefox`	Medium	Ubuntu	–	–	allow a held snap to auto-refresh again — param: name*; Ubuntu only
`SnapList`	`snap list`	Low	Ubuntu	–	–	list installed snaps — no params; Ubuntu only; read-only
`SnapInfo`	`snap info firefox`	Low	Ubuntu	–	–	show snap details (version, channel, description) — param: name*; Ubuntu only; read-only
`SnapRevert`	`sudo snap revert firefox`	Medium	Ubuntu	–	–	revert a snap to its previous revision — param: name*; Ubuntu only
`SnapClassicInstall`	`sudo snap install --classic code`	Medium	Ubuntu	–	–	install a snap with classic confinement (full system access) — param: name*; Ubuntu only

ufw

Action	Command	Risk	Distro	Rb	Ro	Description
`UfwEnable`	`sudo ufw --force enable`	High	Ubuntu	–	–	enable the ufw firewall — no params; Ubuntu only; High risk
`UfwDisable`	`sudo ufw disable`	High	Ubuntu	–	–	disable the ufw firewall — no params; Ubuntu only; High risk
`UfwAllow`	`sudo ufw allow 22`	High	Ubuntu	–	–	allow inbound traffic on a port or service — param: port_or_service* (e.g. 22, 22/tcp, OpenSSH); Ubuntu only; High risk
`UfwDeny`	`sudo ufw deny 23`	High	Ubuntu	–	–	deny inbound traffic on a port or service — param: port_or_service*; Ubuntu only; High risk
`UfwReset`	`sudo ufw --force reset`	High	Ubuntu	–	–	reset ufw to defaults, removing all rules — no params; Ubuntu only; High risk; irreversible
`UfwStatus`	`sudo ufw status verbose`	Low	Ubuntu	–	–	show current ufw status and rules — no params; Ubuntu only; read-only
`UfwDeleteRule`	`sudo ufw --force delete 1`	High	Ubuntu	–	–	delete a ufw rule by number — param: rule_number* (positive integer from 'ufw status numbered'); Ubuntu only; High risk
`UfwLimit`	`sudo ufw limit 22`	High	Ubuntu	–	–	add rate-limiting rule on a port/service (>6 connections/30s blocked) — param: target* (e.g. '22' or 'ssh'); Ubuntu only; High risk; use for SSH brute-force mitigation

netplan

Action	Command	Risk	Distro	Rb	Ro	Description
`NetplanGetConfig`	`find /etc/netplan -maxdepth 1 -name *.yaml -print -exec cat {} +`	Low	Ubuntu	–	–	read the SAVED network configuration: the netplan YAML in /etc/netplan/ — no params; Ubuntu only; read-only; on Ubuntu this is what "the network config" means, as opposed to GetNetworkStatus which reports live interface state
`NetplanApply`	`sudo netplan apply`	High	Ubuntu	–	–	apply netplan network configuration immediately — no params; Ubuntu only; High risk; can disconnect SSH
`NetplanSet`	`sudo netplan set ethernets.eth0.dhcp4=true`	High	Ubuntu	–	–	set a single netplan key to a value — params: key* (e.g. 'ethernets.eth0.dhcp4'), value*; Ubuntu only; High risk; run NetplanApply to activate
`NetplanGenerate`	`sudo netplan generate`	Medium	Ubuntu	–	–	regenerate netplan backend config without applying — no params; Ubuntu only; Medium risk; dry-run before NetplanApply

distrobox

Action	Command	Risk	Distro	Rb	Ro	Description
`DistroboxList`	`distrobox list`	Low	Ubuntu	–	–	list distrobox containers — no params; Ubuntu only; read-only
`DistroboxCreate`	`distrobox create --yes --name dev --image ubuntu:24.04`	Medium	Ubuntu	–	–	create a distrobox container — params: name, image (e.g. ubuntu:24.04, fedora:41); Ubuntu only
`DistroboxRemove`	`distrobox rm --force dev`	Medium	Ubuntu	–	–	remove a distrobox container — param: name*; Ubuntu only

GRUB

Action	Command	Risk	Distro	Rb	Ro	Description
`GrubGetKargs`	`grep -E ^GRUB_CMDLINE_LINUX /etc/default/grub`	Low	Ubuntu	–	–	read current GRUB_CMDLINE_LINUX from /etc/default/grub — no params; Ubuntu only; read-only
`GrubSetKargs`	`sudo /usr/lib/sysknife/grub-kargs-edit --append quiet --delete splash`	High	Ubuntu	✓	–	modify GRUB kernel arguments and run update-grub — params: append (list), delete (list), bare tokens only (no '='); both lists are screened for boot-security downgrades; Ubuntu only; High risk; requires reboot

Ubuntu release upgrade

Action	Command	Risk	Distro	Rb	Ro	Description
`UbuntuReleaseUpgrade`	`sudo do-release-upgrade -f DistUpgradeViewNonInteractive`	High	Ubuntu	✓	–	upgrade to the next Ubuntu release (do-release-upgrade) — no params; Ubuntu only; High risk; takes 20–45 min; requires reboot; only for explicit distribution upgrade requests

Ubuntu Pro

Action	Command	Risk	Distro	Rb	Ro	Description
`ProStatus`	`pro status --all`	Low	Ubuntu	–	–	show Ubuntu Pro subscription status — no params; Ubuntu only; read-only
`ProAttach`	`sudo pro attach <REDACTED>`	High	Ubuntu	–	–	attach machine to an Ubuntu Pro subscription — param: token* (credential, never log); Ubuntu only; High risk
`ProDetach`	`sudo pro detach --assume-yes`	High	Ubuntu	–	–	detach from Ubuntu Pro subscription — no params; Ubuntu only; High risk
`EnableProService`	`sudo pro enable esm-apps --assume-yes`	High	Ubuntu	–	–	enable one Ubuntu Pro service (pro enable <service>) — param: service* (one of esm-apps, esm-infra, livepatch, usg, fips, fips-updates, cis, ros, ros-updates, cc-eal, realtime-kernel, landscape, anbox-cloud); Ubuntu only; High risk; needs an attached subscription
`DisableProService`	`sudo pro disable esm-apps --assume-yes`	High	Ubuntu	–	–	disable one Ubuntu Pro service (pro disable <service>) — param: service* (same allowlist as EnableProService); Ubuntu only; High risk

Livepatch

Action	Command	Risk	Distro	Rb	Ro	Description
`LivepatchStatus`	`sudo canonical-livepatch status --verbose`	Low	Ubuntu	–	–	show Canonical Livepatch kernel-patch status — no params; Ubuntu only; read-only; requires canonical-livepatch installed and Ubuntu Pro

Multipass

Action	Command	Risk	Distro	Rb	Ro	Description
`MultipassList`	`multipass list`	Low	Ubuntu	–	–	list Multipass VMs and their state — no params; Ubuntu only; read-only

189 actions have an ActionSpec and are tabled above. The full catalogue (KNOWN_ACTION_NAMES) also includes ListJobHistory, which the dispatcher handles before the executor, for 190 total.

SysKnife