Filters

A filter is what stops your tweak being loaded into every process on the machine. It lives at Contents/Resources/Filter.plist inside a bundle, as a Filter dictionary in Contents/Info.plist, or as a sibling .plist next to a plain dynamic library.

Keys and accepted values

KeyTypeAccepted values and matching
Bundlesarray Bundle identifiers. Exact match, case-insensitive. Matches the main bundle or any bundle already loaded in the process, so a framework identifier matches too.
Executablesarray Executable file names. Exact match on the last path component, case-insensitive. Not a substring match.
Classesarray Objective-C class names. Matches when the class exists in the host. Exact and case-sensitive.
ExcludeBundlesarray Bundle identifiers that must never match. Evaluated before everything else; same comparison as Bundles.
Typestring Only App and Binary are evaluated. App requires the host to be an application, Binary requires that it is not. Any other value, including Any, imposes no restriction.
Privilegestring Only Root and User are evaluated, case-insensitively, against the effective user ID. Root requires euid 0, User requires non-zero.
CoreFoundationVersionarray One or two numbers, [minimum, maximum). The minimum is inclusive, the maximum exclusive. Elements past the second are ignored.

How the keys combine

Bundles, Executables and Classes are alternatives: any one matching is sufficient. Type, Privilege, CoreFoundationVersion and ExcludeBundles are restrictions applied on top of them.

An empty filter therefore matches nothing, and a filter containing only Type or only Privilege matches every process that passes it. Name your targets explicitly.

Example

Filter.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Bundles</key>
    <array>
        <string>com.apple.dock</string>
    </array>
    <key>Privilege</key>
    <string>User</string>
</dict>
</plist>