rules-privacy-linux

Accessing the GNOME keyring retrieves passwords, tokens, and secrets stored by desktop applications. This includes WiFi passwords, email credentials, and application API keys.

Reading browser history databases accesses private browsing data including visited URLs, search queries, and timestamps. This data is personal and should not be read by AI agents.

/proc/<pid>/environ and /proc/self/environ expose the full environment of running processes, which often includes API keys, database passwords, auth tokens, and other sensitive credentials passed via environment variables.

/etc/shadow contains hashed passwords for all local accounts. Reading it (even just to copy) combined with hashcat/john is offline password cracking. This is never a legitimate development activity.

Reading shell history exposes all commands a user has run, which may include passwords typed by mistake, API keys, and personal workflow data.

Reading user activity logs (wtmp, lastlog, journald) reveals when users logged in, from where, and command history — personal activity data that should not be collected without consent.

Reading user mail files or mail spool entries accesses private communications. Email content is personal data protected by privacy laws in many jurisdictions.

Reading SSH private key files exposes authentication credentials that grant access to remote servers. Private keys should never be read, copied, or transmitted by an AI agent.

Attaching strace or ltrace to a running process intercepts all system calls including reads and writes of sensitive data such as passwords, tokens, and private file content in memory. This is equivalent to live credential interception.