LÁZÁR Imre AI Agent
32cb5b765b
Re-architect the baseline as constituents + a generator script (build-baseline.sh) instead of a checked-out deployed tree: a deployed Joomla docroot differs from the repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py), places no-source and Cadline files, applies core overrides, excludes malware/data, and emits out/ = the code baseline the operator HIDS verifier consumes. Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs. Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8
22 lines
866 B
Plaintext
22 lines
866 B
Plaintext
# Machine-readable malware/planted paths (docroot-relative) excluded from the baseline.
|
|
# Consumed by build-baseline.sh step 6. Rationale + IOC detail in malware-iocs.md.
|
|
# NOTE: the 3 injected core files (auth/joomla.php, session/storage.php, event/event.php)
|
|
# are NOT listed here — they are RESTORED to clean vanilla by the official core package.
|
|
wp-stomp.php
|
|
hyjhxp.php
|
|
libraries/joomla/session/cache.php
|
|
administrator/components/com_joomlaupdate/never.php
|
|
modules/mod_seolite
|
|
modules/mod_articles_single
|
|
modules/mod_al_upload/b8.php
|
|
modules/mod_course_list/a1.php
|
|
templates/trada/html/mod_articles_category/meant.php
|
|
templates/category/tiny.php
|
|
templates/system/links.db
|
|
components/com_extplorer
|
|
administrator/components/com_extplorer
|
|
components/com_joml_incf
|
|
administrator/components/com_joml_incf
|
|
components/com_sys_rom
|
|
administrator/components/com_sys_rom
|