User confirmation prompts and headless devices
A change that is neither clearly safe nor a proven attack is held: the file is left in its safe state and you are asked before it takes effect. This page covers what the user confirmation prompt shows, why no answer means reject, and how headless devices are handled.
The middle band
Most changes are decided without you: clearly safe edits pass, proven attacks are reverted automatically. The band in between is where you get a user confirmation prompt:
- Held: the change is not applied; the file stays in its last safe state. A newly created file has no earlier state - declining moves the whole file into quarantine, from where it can be restored.
- Asked: you are shown the change and asked to decide, with a deadline.
- Reject on no answer: if you do not clearly keep it, the change is rolled back.
What you see
The user confirmation prompt names exactly what happened and lets you answer with two buttons, Keep or Reject. It shows only the added line, quoted from the file so it does not read as PoisonZero speaking:
| Shown | Meaning |
|---|---|
| File | The full path of the file that changed |
| Changed | When the line was added (from the data, not "just now") |
| The new line | The added line, quoted verbatim from the file |
| Recommendation | One plain sentence; there is no wording that recommends Keep |
| Keep | Leave the line in place; PoisonZero records that it came from you and changes nothing |
| Reject | Remove the line; the file is put back to its safe state (the change is quarantined, nothing is deleted for good) |
Headless devices
On a server with no desktop user to answer prompts, the user confirmation-prompt handling is pinned with PZ_HEADLESS (or the installer flag --headless). The value is written to a headlessmode file that the daemon reads:
| Headless mode | Behavior |
|---|---|
none (default) | Auto-detect from the active console user: a user is present, ask as above; truly headless, the strict handling applies. |
standard | The middle band proceeds without a prompt. Proven attacks are still reverted automatically. |
strict | The middle band is rolled back immediately, no prompt. |
Pin the mode at install time (an empty or absent value means auto-detect):
curl -fsSL https://poisonzero.com/install.sh | sudo \ PZ_APP_ID="your-app-id" PZ_ENROLL_CODE="your-code" PZ_HEADLESS="strict" sh
# an explicit --headless flag wins over PZ_HEADLESS sh ./install.sh --headless standard
Read next
Where the flag is set during rollout: installing PoisonZero. In Cloud mode you see only the redacted diff: what Cloud mode sends.
When in doubt, PoisonZero asks before it acts.
Held safely, one clear question, and no answer counts as reject. Free for Linux, macOS and Windows.
Sign me up