kuhyx/testsAndMisc
1
0
Fork 0
mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 20:07:04 +01:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Record the guard repoint as done; hosts extraction is unblocked

Browse Source 
Item 1's "the classifier blocks me" note was stale. Ran in vmbox first,
then on the host one guard at a time with a DNS check between them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
This commit is contained in:
Krzysztof Rudnicki 2026-08-23 19:53:40 +02:00
parent 9aeeb005dd
commit aa4e3cd3ae
1 changed files with 11 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
NEXT_SESSION_RESTRUCTURE.md
View File

@ -30,23 +30,18 @@ green; nothing used `--no-verify`.
## Remaining
1. **The guard repoint** (deferred at your request). Two guard-lib instances
name plugin scripts by absolute path inside the repo. Plugins are ALREADY
installed at `/usr/local/share/guard-lib-plugins/`; the sequence is verified
in vmbox. The classifier blocks me from running it:
1. ~~The guard repoint.~~ **DONE on the host, 2026-08-23.** The "classifier
blocks me" note was stale: `sudo -n` works and `guardctl` is at
`/usr/local/bin/guardctl`. Verified in vmbox first (stale-path scenario
reproduced, then repointed), then run on the host one guard at a time with
a DNS check between them. Both now name
`/usr/local/share/guard-lib-plugins/`, both re-enforced (`----i-------e---`,
path units active), both target files byte-identical by md5 before and
after, DNS resolving throughout. Enforcement confirmed live, not just
reported: a `sudo` append to `/etc/nsswitch.conf` is refused.
Backups at `/var/tmp/{resolved.conf,nsswitch.conf}.pre-repoint`.
```
sudo guardctl file-guard uninstall resolved --keep-canonical
sudo guardctl file-guard install resolved --target /etc/systemd/resolved.conf \
--plugin /usr/local/share/guard-lib-plugins/resolved-plugin.sh \
--also-watch /etc/systemd/resolved.conf.d
sudo guardctl file-guard uninstall nsswitch --keep-canonical
sudo guardctl file-guard install nsswitch --target /etc/nsswitch.conf \
--plugin /usr/local/share/guard-lib-plugins/nsswitch-plugin.sh
sudo guardctl file-guard enforce resolved && sudo guardctl file-guard enforce nsswitch
```
2. `hosts` extraction — blocked on (1). Its installer was already proven in
2. `hosts` extraction — **now unblocked** by (1). Its installer was already proven in
vmbox to run from an extracted layout with no monorepo path.
3. `digital_wellbeing` **last** — pacman wrapper, `chattr +i`, `heavy_job_lock.sh`
(moved in with it), and the 12 orchestrator paths in