CLI man page:
safesquid-profiles(5)safesquid-profiles(5)) is the central content-policy hub. Access restrictions decide who connects; Access Profiles decide what they may fetch. It combines Time Profiler, Request Types, Response Types, categories, and User-Groups, then adds profile tags and sets Allow/Deny.
Unlike Access restrictions (first match), every matching row in Default and Secondary Policies applies. Later rows see tags changed by earlier rows.
Profile pipeline
On each request (non-interface), SafeSquid builds label lists in this order before Access Profiles runs:- Time Profiler →
time_schedules - Request Types →
request_types - Domain categorization →
website_categories - Access Profiles →
profiles+action - Response Types on response headers/body → updates
response_types; Access Profiles runs again
user_groups (not profiles). Access Profiles User Groups gate matches those tags.
Core mechanics
List order
- Clear the connection’s profile tags; set the action to ALLOW.
- Walk Default Policies top-down — every match applies.
- Walk Secondary Policies top-down — same cumulative rules.
- Final action not Allow → block (bypass cookie may apply).
Access Profiles — gate order per row
Action values
- Allow — Default. Downstream sections use applied profile tags.
- Deny — Block. With Access Allow bypassing, temporary bypass cookie may be offered.
- Do not bypass — Hard block; no bypass cookie.
- Inherit — Keep action from earlier matching rows; use when row only adds/removes tags.
Rule fields
All configured criteria on a row must match. Blank = any. Use! to negate tags in list fields.
- Applicable Profiles — Tags on connection from earlier rows in this pass (list is cleared at start).
- Time Schedule — Tags from Time Profiler.
- Request Types — Tags from Request Types.
- Response Types — Tags from Response Types; requires response header when field set.
- User Groups — From Access restrictions. Non-blank + empty user_groups → row skipped.
- Categories — Domain categories; empty lookup tests as
UNCATEGORIZED.
Examples
How to verify
- Reports → Detailed logs — profiles, request/response/time profile columns.
- Enable Trace Entry on one row; check native logs.
- Debug headers —
X-SafeSquid-Profiles,X-SafeSquid-Access-Policy.