Skip to main content Module actions Copy item path Source apparmor AppArmor profile management actions (Ubuntu / Debian). apt apt-family package management actions (Ubuntu / Debian). apt_preferences apt package pinning (/etc/apt/preferences.d/). Debian-family only. auditd auditd file-watch rule actions. certbot certbot / ACME certificate actions. cloudinit cloud-init status action (Ubuntu / Debian). containers deployment distrobox Distrobox container lifecycle actions (cross-distro toolbox replacement). fail2ban fail2ban intrusion-prevention actions (Ubuntu / Debian). filesystem flatpak grub GRUB kernel argument actions (Ubuntu). identity journald journald query + maintenance actions. layering livepatch Canonical Livepatch status action (Ubuntu Pro). logging Log-management actions: logrotate drop-ins + rsyslog remote forwarding. lvm LVM (Logical Volume Manager) storage actions. mounts Filesystem mount + swap actions. multipass Multipass VM management actions (Ubuntu). netplan Netplan network configuration actions (Ubuntu Server). network package_repos pam PAM password-policy + account-aging actions. ppa PPA (Personal Package Archive) management actions (Ubuntu). processes reboot Pending-reboot detection action (Ubuntu / Debian). release_upgrade Ubuntu release upgrade action. resolvectl resolvectl actions — DNS status and configuration via systemd-resolved. services snap snap package management actions (Ubuntu). ssh sudoers Scoped sudoers.d management. sysctl sysctl kernel-parameter actions. system_info toolbox ubuntu_pro Ubuntu Pro (Advantage) subscription actions. ufw Ubuntu Uncomplicated Firewall (ufw) actions. users ActionSpec SpecMeta Static per-action metadata that lives on the ActionSpecspec_meta ActionMechanism ExclusiveResource A system-wide lock that only one mutating action may hold at a time. DISPATCHER_INTERNAL_ACTIONS Actions handled by the dispatcher before reaching the executor. These are
part of the public action catalogue but deliberately have no ActionSpec. OBSERVER_MUTATING_ACTIONS Observer-callable actions that still mutate the host and therefore require
the preview/approve/execute interlock. all_specs Every action spec, flattened from catalogue catalogue The canonical catalogue of every action the daemon recognises, grouped by
domain. This is the single source of truth for per-action static
metadata (risk_level, reboot_required, rollback_available): the
preview/approval gate (preview.rs), the RBAC role table (policy.rs), and
docs/action-reference.md all derive from — or are consistency-tested
against — this list rather than re-declaring risk. The section titles are
the only hand-authored presentation input. See tests/action_consistency.rs
for the invariants that pin the derived tables to this catalogue. exclusive_resource Which system lock, if any, this action contends for. spec_meta Canonical static metadata for action_name, or None for actions with no
ActionSpec (e.g. the dispatcher-internal ListJobHistory).