# Exclude data directory from most binary policies since these
# files typically execute on other systems or have specific reasons
# for violating policies
arch-dependent-file-in-usr-share [usr/share/metasploit-framework/data/*]
binary-from-other-architecture [usr/share/metasploit-framework/data/*]
binary-has-unneeded-section * [usr/share/metasploit-framework/data/*]
elf-error * [usr/share/metasploit-framework/data/*]
executable-jar-without-main-class [usr/share/metasploit-framework/data/*]
font-in-non-font-package [usr/share/metasploit-framework/data/*]
font-outside-font-dir [usr/share/metasploit-framework/data/*]
hardening-no-bindnow [usr/share/metasploit-framework/data/*]
hardening-no-fortify-functions [usr/share/metasploit-framework/data/*]
hardening-no-pie [usr/share/metasploit-framework/data/*]
hardening-no-relro [usr/share/metasploit-framework/data/*]
image-file-has-conflicting-name * [usr/share/metasploit-framework/data/*]
missing-dependency-on-libc * usr/share/metasploit-framework/data/*
missing-manifest [usr/share/metasploit-framework/data/*]
no-code-sections [usr/share/metasploit-framework/data/*]
package-installs-java-bytecode [usr/share/metasploit-framework/data/*]
privacy-breach-generic * [usr/share/metasploit-framework/data/*]
shared-lib-without-dependency-information [usr/share/metasploit-framework/data/*]
spelling-error-in-binary * [usr/share/metasploit-framework/data/*]
statically-linked-binary [usr/share/metasploit-framework/data/*]
truetype-font-prohibits-installable-embedding * [usr/share/metasploit-framework/data/*]
unstripped-binary-or-object [usr/share/metasploit-framework/data/*]
unusual-interpreter /usr/bin/python [usr/share/metasploit-framework/data/*]

# Also ignore everything in the ruby bundle
arch-dependent-file-in-usr-share [usr/share/metasploit-framework/vendor/bundle/*]
bash-term-in-posix-shell * [usr/share/metasploit-framework/vendor/bundle/*]
binary-from-other-architecture [usr/share/metasploit-framework/vendor/bundle/*]
custom-library-search-path * [usr/share/metasploit-framework/vendor/bundle/*]
elf-error * [usr/share/metasploit-framework/vendor/bundle/*]
extra-license-file [usr/share/metasploit-framework/vendor/bundle/*]
file-references-package-build-path [usr/share/metasploit-framework/vendor/bundle/*]
hardening-no-fortify-functions [usr/share/metasploit-framework/vendor/bundle/*]
missing-dep-for-interpreter * [usr/share/metasploit-framework/vendor/bundle/*]
package-contains-empty-directory [usr/share/metasploit-framework/vendor/bundle/*]
package-installs-ieee-data [usr/share/metasploit-framework/vendor/bundle/*]
ruby-script-but-no-ruby-dep * [usr/share/metasploit-framework/vendor/bundle/*]
shared-library-lacks-prerequisites [usr/share/metasploit-framework/vendor/bundle/*]
spelling-error-in-binary * [usr/share/metasploit-framework/vendor/bundle/*]
unstripped-binary-or-object [usr/share/metasploit-framework/vendor/bundle/*]
unusual-interpreter * [usr/share/metasploit-framework/vendor/bundle/*]
windows-devel-file-in-package [usr/share/metasploit-framework/vendor/bundle/*]
metasploit-framework: embedded-library * [usr/share/metasploit-framework/vendor/bundle/*]

# The executable jars are a mistake
missing-dep-on-jarwrapper

# Really not important
arch-dep-package-has-big-usr-share *
national-encoding [*]
package-contains-documentation-outside-usr-share-doc [*]
possible-documentation-but-no-doc-base-registration
script-not-executable [*]
package-contains-vcs-control-file [*]
executable-not-elf-or-script [*]

# We have a custom ruby interpreter
wrong-path-for-interpreter * [usr/share/metasploit-framework/msf*]
wrong-path-for-interpreter * [usr/share/metasploit-framework/tools/*.rb]

# Mettle binaries are target payloads for multiple operating systems, not host
# programs. Static linkage is necessary for deployment to those targets.
statically-linked-binary [usr/share/metasploit-framework/vendor/bundle/ruby/*/gems/metasploit_payloads-mettle-*/build/*/bin/*]
# Rails keeps an ERB template with a shell shebang; it is not valid shell until
# ERB renders it while generating an application. Preserve the template bytes.
shell-script-fails-syntax-check [usr/share/metasploit-framework/vendor/bundle/ruby/*/gems/railties-*/lib/rails/generators/rails/app/templates/docker-entrypoint.tt]
# This uninvoked vendored LicenseFinder helper is preserved for the gem's
# developer tooling; the Framework runtime uses Python 3 and does not call it.
script-uses-unversioned-python-in-shebang [usr/share/metasploit-framework/vendor/bundle/ruby/*/bundler/gems/LicenseFinder-*/bin/license_finder_pip.py]
# RDoc's Darkfish documentation template embeds its own CSS/font assets. Keep
# the bundled template self-contained; do not rewrite its resource paths.
duplicate-font-file also in (fonts-lato) [usr/share/metasploit-framework/vendor/bundle/ruby/*/gems/rdoc-*/lib/rdoc/generator/template/darkfish/fonts/*.ttf]
font-in-non-font-package [usr/share/metasploit-framework/vendor/bundle/ruby/*/gems/rdoc-*/lib/rdoc/generator/template/darkfish/fonts/*.ttf]
# The gzip timestamp and Python interpreter are part of target exploit data.
# Rewriting exploit resources can change payload behaviour.
package-contains-timestamped-gzip * [usr/share/metasploit-framework/data/exploits/pxexploit/update3]
unusual-interpreter python [usr/share/metasploit-framework/data/exploits/CVE-2026-31431/*.py]
