Little Snitch Help

The .lsrules file format

Rule group subscriptions use a .lsrules file, which is a JSON format specified in this chapter. Such files can be exported using Little Snitch Configuration or using a text editor or a script.

An example

Let’s start with a simple example that specifies a single rule for allowing software updates for LaunchBar:

  "name": "LaunchBar Software Update",
  "description": "This rule allows LaunchBar to check for updates.",
  "rules": [
      "action": "allow",
      "process": "/Applications/",
      "remote-hosts": ""

Top-level keys

The top level of an .lsrules file is a JSON dictionary with the following keys:

Key Type Description
name String The name of the group.
description String A description of the rule grouop.
rules Array of Dictionaries The list of rules. See below for rule-level keys.

Rule keys

Each rule defined in the file is a JSON dictionary with the following keys:

Specifying the process

To define which processes a rule should match, you specify the executable of the process using the following keys:

Usually, processes must have a valid code signature for Little Snitch to allow connections. If you want to provide a rule that ignores the code signature of a process, add "codeSignature": "ignore".

Specifying the remote

The remote for the rule can be specified in multiple ways. You can only provide one of the following keys:

Other keys

Key Type Description
direction String, optional The connection direction. "incoming" or "outgoing", defaults to "outgoing".
action String, optional The rule action. "allow", "deny", or "ask". Defaults to "ask".
priority String, optional The rule priority. "regular" or "high". Defaults to "regular".
disabled Boolean, optional Whether or not the rule is disabled by default. Defaults to false.
ports String, optional The ports the rule matches. Can be "any" for any port (the default), a single port (e.g. "443"), or a range of ports (e.g. "123-456").
protocol String, optional The protocol the rule matches. Can be a numeric value as defined in /etc/protocols, like "6" for TCP, or the actual protocol name, like "tcp". Defaults to any protocol.
notes String, optional The notes for the rule.

Was this help page useful? Send feedback.
© 2016-2019 by Objective Development Software GmbH