From ad46fc85a58b596e296aa5708c09f8524ae10bac Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Sat, 17 Oct 2026 18:46:17 +0200 Subject: [PATCH] pacman wrapper: drop list-file checks and docs after list retirement digital-wellbeing e2a7176 removed the blocked-keyword, white and grey lists. check_pacman_wrapper no longer looks for them, the VirtualBox note stops citing pacman policy, and the docs drop the lists and greylist challenge. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_016Lhzv7c391mTKWfwU17V7Z --- .../drop-pacman-policy-lists-2026-10-17.json | 34 +++++++++++++++++++ .../.github/copilot-instructions.md | 4 +-- .../docs/DOCS-pacman-security-layers.md | 32 ++++++++--------- .../docs/DOCS-pacman-wrapper-security.md | 26 +++++++------- .../pacman-wrapper/DOCS-testing-and-usage.md | 17 +++++----- .../DOCS-01-current-state.md | 12 +++---- .../DOCS-03-implementation.md | 9 +---- .../DOCS-04-agent-personas.md | 17 ++++------ .../security-hardening/DOCS-05-llm-readmes.md | 12 +++---- .../DOCS-06-test-template.md | 9 +---- .../lib/services_browser.sh | 12 +++---- .../lib/services_wrappers.sh | 12 +++---- .../lib/tests/test_services_wrappers.sh | 4 +-- 13 files changed, 101 insertions(+), 99 deletions(-) create mode 100644 docs/superpowers/evidence/drop-pacman-policy-lists-2026-10-17.json diff --git a/docs/superpowers/evidence/drop-pacman-policy-lists-2026-10-17.json b/docs/superpowers/evidence/drop-pacman-policy-lists-2026-10-17.json new file mode 100644 index 00000000..fdb7eb5d --- /dev/null +++ b/docs/superpowers/evidence/drop-pacman-policy-lists-2026-10-17.json @@ -0,0 +1,34 @@ +{ + "intent": "The pacman wrapper no longer has blocked-keyword, white or grey lists (removed in digital-wellbeing e2a7176); stop the services checker and docs from expecting them.", + "scope": [ + "linux_configuration/periodic_background/lib/services_wrappers.sh and its test", + "linux_configuration/periodic_background/lib/services_browser.sh comment + note", + "linux_configuration/.github/copilot-instructions.md and linux_configuration/docs pacman docs", + "Non-goal: the wrapper itself lives in ~/src/digital-wellbeing" + ], + "changes": [ + "check_pacman_wrapper only checks words.txt as a supporting file, no longer pacman_blocked_keywords.txt / pacman_whitelist.txt", + "test_services_wrappers.sh stages and removes only words.txt", + "VirtualBox n/a note no longer claims it is blocked by pacman policy", + "Docs drop the list files, greylist challenge and comparisons; integrity/immutability text now names the lock lib and pw_*.sh" + ], + "verification": [ + { + "command": "bash linux_configuration/periodic_background/lib/tests/run_all.sh", + "result": "pass", + "evidence": "test_services_wrappers.sh: 29 passed, 0 failed; All check_and_enable_services test files passed." + }, + { + "command": "bash linux_configuration/periodic_background/check_and_enable_services.sh --status", + "result": "pass", + "evidence": "Supporting file exists: /usr/local/bin/words.txt; no list-file lines; 'VirtualBox not installed — not applicable'. Drift flagged as expected until the hourly reinstall deploys digital-wellbeing e2a7176." + } + ], + "risks": [ + "VirtualBox is now installable without friction; only post-transaction VM removal remains" + ], + "rollback": [ + "git revert this commit together with digital-wellbeing e2a7176", + "Re-run install_pacman_wrapper.sh and check_and_enable_services.sh --status" + ] +} diff --git a/linux_configuration/.github/copilot-instructions.md b/linux_configuration/.github/copilot-instructions.md index 0e12be07..5ffd3adb 100644 --- a/linux_configuration/.github/copilot-instructions.md +++ b/linux_configuration/.github/copilot-instructions.md @@ -9,7 +9,7 @@ This repo automates Linux desktop bootstrap, hardening, and i3 setup. It’s pri - `hosts/install.sh` builds and locks `/etc/hosts` (immutable/append-only; selective unblocks; custom blocks). - `hosts/guard/` enforcement is provided by guard-lib (`guardctl`, installed outside this repo): a `file-guard` instance per target (`hosts`, `nsswitch`, `resolved`) with a path-watcher, optional RO bind mount, generic pacman hooks, and per-target plugins under `hosts/guard/plugins/`. The pre-guard-lib scripts (`setup_hosts_guard.sh`, `enforce-*.sh`, per-target systemd units, `psychological/unlock-hosts.sh`) are archived at github.com/kuhyx/testsAndMisc-archive — see `./fixes/migrate_hosts_guard_to_guard_lib.sh` for how the migration works. - periodic_background/digital_wellbeing/pacman/: a policy-aware pacman wrapper with friction mechanics. - - `pacman_wrapper.sh` intercepts transactions, runs hosts-guard pre/post hooks, handles stale db lock, auto-wires maintenance services, and enforces package policy (blocked/whitelisted lists); adds weekend-only “Steam” challenge and a VirtualBox challenge powered by `words.txt`. + - `pacman_wrapper.sh` intercepts transactions, runs hosts-guard pre/post hooks, handles stale db lock, auto-wires maintenance services, adds a weekend-only “Steam” challenge powered by `words.txt`, and removes VirtualBox VMs after each transaction. It has no package block/allow lists (retired 2026-10-17; hosts/DNS blocking covers that). - `install_pacman_wrapper.sh` backs up `/usr/bin/pacman` to `pacman.orig` and symlinks to the wrapper. - periodic_background/system-maintenance/: templates and installer for periodic jobs and monitoring. - `setup_periodic_system.sh` installs: `/usr/local/bin/periodic-system-maintenance.sh`, a timer (`periodic-system-maintenance.timer`), a startup oneshot, and `hosts-file-monitor.service` that restores `/etc/hosts` if tampered. Also installs a browser pre-exec wrapper that re-runs the hosts installer before launching common browsers. @@ -44,7 +44,7 @@ This repo automates Linux desktop bootstrap, hardening, and i3 setup. It’s pri - Follow the sudo re-exec + idempotent install pattern from `setup_periodic_system.sh` and `./fixes/migrate_hosts_guard_to_guard_lib.sh`. - Add new periodic behaviors as templates under `periodic_background/system-maintenance/bin` and `.../systemd`, then extend `setup_periodic_system.sh` to install/enable them. -- Extend package policy by updating `periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt` or by adding `check_for_` + `prompt_for__challenge` blocks in the wrapper. +- Add package friction by adding `check_for_` + `prompt_for__challenge` blocks in the wrapper (now in github.com/kuhyx/digital-wellbeing). - Run `meta/shell_check.sh` to detect things to fix before committing. ## Detailed LLM Documentation diff --git a/linux_configuration/docs/DOCS-pacman-security-layers.md b/linux_configuration/docs/DOCS-pacman-security-layers.md index 714b731e..9f7a1eb0 100644 --- a/linux_configuration/docs/DOCS-pacman-security-layers.md +++ b/linux_configuration/docs/DOCS-pacman-security-layers.md @@ -4,22 +4,22 @@ The pacman wrapper had two critical security vulnerabilities: -1. **Easy Policy Bypass**: Users could edit `pacman_greylist.txt` to remove "virtualbox", reinstall the wrapper, and bypass all restrictions. +1. **Easy Policy Bypass**: Users could edit the wrapper's helper libs (`pacman_lock_lib.sh`, `pw_*.sh`) to remove restrictions, reinstall the wrapper, and bypass them. 2. **VirtualBox Hosts Bypass**: VirtualBox VMs do not inherit the host's `/etc/hosts` file, allowing complete circumvention of content filtering inside VMs. ## Solution Overview Implemented a **defense-in-depth** security architecture with multiple layers: -### Layer 1: Immutable Policy Files +### Layer 1: Immutable Lock Lib -- Policy files (`pacman_blocked_keywords.txt`, `pacman_greylist.txt`) are made immutable using `chattr +i` +- The lock lib (`pacman_lock_lib.sh`) is made immutable using `chattr +i`; the `pw_*.sh` libs are only checksummed - Prevents casual editing without root access and knowledge of filesystem attributes - Requires explicit `chattr -i` command to modify ### Layer 2: SHA256 Integrity Checks -- SHA256 checksums generated for all policy files during installation +- SHA256 checksums generated for the wrapper libs during installation - Stored in `/var/lib/pacman-wrapper/policy.sha256` (also made immutable) - **Every wrapper invocation** verifies file integrity before proceeding - **Blocks all operations** if tampering is detected @@ -29,11 +29,11 @@ Implemented a **defense-in-depth** security architecture with multiple layers: - VirtualBox detection is **compiled into the wrapper code** - Cannot be bypassed by editing any text file - Catches all packages matching `*virtualbox*` or `*vbox*` patterns -- More difficult challenge than standard greylist: - - 7-letter words (vs 6 for greylist) - - 150 words to memorize (vs 120) - - 120-second timeout (vs 90s) - - 45-second initial delay (vs 30s) +- Difficult word challenge: + - 7-letter words + - 150 words to memorize + - 120-second timeout + - 45-second initial delay ### Layer 4: VirtualBox Enforcement @@ -69,7 +69,7 @@ Implemented a **defense-in-depth** security architecture with multiple layers: ### What's Now Protected -✅ Policy files cannot be easily modified (immutable + checksums) +✅ Wrapper libs cannot be modified unnoticed (lock lib immutable, all libs checksummed) ✅ VirtualBox restrictions are hardcoded (cannot bypass via file editing) ✅ VMs inherit host's content filtering (DNS proxy + shared hosts) ✅ Tampering is immediately detected and blocked @@ -96,7 +96,7 @@ Tests verify: - Integrity check function exists and is called early - Hardcoded VirtualBox detection exists - VirtualBox challenge function exists -- Policy files are made immutable +- The lock lib is made immutable - VirtualBox enforcement is integrated - Error handling is proper @@ -109,9 +109,9 @@ sudo ./install_pacman_wrapper.sh This will: -1. Install wrapper and policy files +1. Install wrapper and wrapper libs 2. Generate SHA256 checksums -3. Make policy files immutable with `chattr +i` +3. Make the lock lib immutable with `chattr +i` 4. Install VirtualBox enforcement script 5. Set up automatic enforcement @@ -128,15 +128,15 @@ This will: - Must complete difficult word challenge (7-letter words, 120s timeout) - Enhanced warnings about security implications - Automatic VM configuration after successful installation -- Cannot bypass by editing policy files +- Cannot bypass by editing wrapper libs ### For Updating Policies If legitimate policy updates are needed: ```bash -sudo chattr -i /usr/local/bin/pacman_greylist.txt -sudo nano /usr/local/bin/pacman_greylist.txt +sudo chattr -i /usr/local/bin/pacman_lock_lib.sh +sudo nano /usr/local/bin/pacman_lock_lib.sh cd periodic_background/digital_wellbeing/pacman sudo ./install_pacman_wrapper.sh # Regenerates checksums ``` diff --git a/linux_configuration/docs/DOCS-pacman-wrapper-security.md b/linux_configuration/docs/DOCS-pacman-wrapper-security.md index 53443ef7..30345efd 100644 --- a/linux_configuration/docs/DOCS-pacman-wrapper-security.md +++ b/linux_configuration/docs/DOCS-pacman-wrapper-security.md @@ -8,35 +8,35 @@ This document describes the security enhancements made to the pacman wrapper to The original pacman wrapper had the following vulnerabilities: -1. **Easy Policy Bypass**: Users could edit `pacman_greylist.txt` or `pacman_blocked_keywords.txt` to remove restrictions, then reinstall the wrapper. +1. **Easy Policy Bypass**: Users could edit the wrapper's helper libs (`pacman_lock_lib.sh`, `pw_*.sh`) to remove restrictions, then reinstall the wrapper. 2. **VirtualBox Hosts Bypass**: VirtualBox VMs do not inherit the host machine's `/etc/hosts` file, allowing users to bypass content filtering within VMs. -3. **No Tamper Detection**: The wrapper had no mechanism to detect if policy files had been modified. +3. **No Tamper Detection**: The wrapper had no mechanism to detect if wrapper libs had been modified. ## Solutions Implemented -### 1. Policy File Integrity Checks +### 1. Wrapper Lib Integrity Checks **File**: `periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh` The installer now: -- Generates SHA256 checksums of all policy files during installation +- Generates SHA256 checksums of all wrapper libs during installation - Stores checksums in `/var/lib/pacman-wrapper/policy.sha256` - Makes the integrity file immutable using `chattr +i` -- Makes policy files (`pacman_blocked_keywords.txt`, `pacman_greylist.txt`) immutable +- Makes the lock lib (`pacman_lock_lib.sh`) immutable **File**: `periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh` The wrapper now: -- Verifies policy file integrity on **every invocation** +- Verifies wrapper lib integrity on **every invocation** - Compares current file checksums against stored checksums - **Blocks all operations** if tampering is detected - Displays security warnings and instructs user to reinstall **Benefits**: -- Cannot bypass restrictions by editing policy files +- Cannot bypass restrictions by editing wrapper libs - Tampering is immediately detected and blocked - Must use `chattr -i` (requires root) to modify files, making bypass harder @@ -44,7 +44,7 @@ The wrapper now: **File**: `periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh` -Added hardcoded VirtualBox detection that **cannot be bypassed** by editing policy files: +Added hardcoded VirtualBox detection that **cannot be bypassed** by editing wrapper libs: ```bash function is_virtualbox_package() { @@ -61,9 +61,9 @@ This function: **Enhanced Challenge**: -- 7-letter words (harder than greylist's 6-letter words) -- 150 words to memorize (more than greylist's 120) -- 120-second timeout (longer than greylist's 90s) +- 7-letter words +- 150 words to memorize +- 120-second timeout - 45-second initial delay (psychological friction) - 30-50 second post-challenge delay @@ -128,13 +128,13 @@ The installer now: ### What's Protected -1. **Policy files cannot be easily modified**: +1. **Wrapper libs cannot be easily modified**: - Immutable attribute prevents casual editing - Requires `chattr -i` which requires root and knowledge - Changes are detected on next wrapper invocation 2. **VirtualBox restrictions are hardcoded**: - - Cannot remove by editing policy files + - Cannot remove by editing wrapper libs - Would require modifying the wrapper code itself - Integrity checks would detect wrapper modification diff --git a/linux_configuration/docs/pacman-wrapper/DOCS-testing-and-usage.md b/linux_configuration/docs/pacman-wrapper/DOCS-testing-and-usage.md index dd57b97a..430ca14a 100644 --- a/linux_configuration/docs/pacman-wrapper/DOCS-testing-and-usage.md +++ b/linux_configuration/docs/pacman-wrapper/DOCS-testing-and-usage.md @@ -28,22 +28,21 @@ sudo ./install_pacman_wrapper.sh This will: -- Install the wrapper and policy files +- Install the wrapper and wrapper libs - Generate integrity checksums -- Make policy files immutable +- Make the lock lib immutable - Install VirtualBox enforcement script -### Updating Policy Files +### Updating Wrapper Libs -If you need to legitimately update policy files: +If you need to legitimately update wrapper libs: ```bash # Remove immutable attribute -sudo chattr -i /usr/local/bin/pacman_blocked_keywords.txt -sudo chattr -i /usr/local/bin/pacman_greylist.txt +sudo chattr -i /usr/local/bin/pacman_lock_lib.sh # Edit files as needed -sudo nano /usr/local/bin/pacman_greylist.txt +sudo nano /usr/local/bin/pacman_lock_lib.sh # Reinstall wrapper to update checksums cd periodic_background/digital_wellbeing/pacman @@ -78,7 +77,7 @@ sudo chmod +x /usr/local/bin/vbox_sync.sh These enhancements follow the principle of **defense in depth**: -- **Layer 1**: Immutable policy files (prevents casual editing) +- **Layer 1**: Immutable lock lib (prevents casual editing) - **Layer 2**: Integrity checksums (detects tampering) - **Layer 3**: Hardcoded restrictions (cannot bypass via files) - **Layer 4**: VirtualBox enforcement (prevents VM bypass) @@ -91,7 +90,7 @@ Each layer adds difficulty, making circumvention progressively harder while main Potential improvements: 1. **Digital signatures**: Sign the wrapper script itself to detect modifications -2. **Remote policy updates**: Fetch policy files from a trusted source +2. **Remote updates**: Fetch wrapper libs from a trusted source 3. **Logging**: Log all wrapper invocations and challenges to detect patterns 4. **Time-based restrictions**: Different rules for different times/days 5. **Multi-factor challenges**: Combine word challenges with other verification methods diff --git a/linux_configuration/docs/security-hardening/DOCS-01-current-state.md b/linux_configuration/docs/security-hardening/DOCS-01-current-state.md index 12cf0ade..770db2a2 100644 --- a/linux_configuration/docs/security-hardening/DOCS-01-current-state.md +++ b/linux_configuration/docs/security-hardening/DOCS-01-current-state.md @@ -80,20 +80,18 @@ **Files involved:** - [periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh](../periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh) (823 lines) -- [periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt](../periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt) - [periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh](../periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh) **Current Protection:** -1. ✅ Policy file integrity verification (SHA256) -2. ✅ Blocked keywords list -3. ✅ Greylist with challenge -4. ✅ VirtualBox hardcoded check (cannot bypass via policy files) -5. ✅ Steam weekend-only restriction +1. ✅ Wrapper lib integrity verification (SHA256) +2. ✅ VirtualBox hardcoded check (cannot bypass via wrapper libs) +3. ✅ Steam weekend-only restriction + +_Note: the package policy lists (blocked keywords, whitelist, greylist) were retired 2026-10-17; hosts/DNS blocking covers them._ **VULNERABILITIES IDENTIFIED:** -- ❌ **Google Chrome not blocked** - `google-chrome` and `google-chrome-stable` missing from blocked list - ❌ No automatic LeechBlock installation when browsers are detected - ❌ User can download `.deb`/`.tar.gz` and install manually diff --git a/linux_configuration/docs/security-hardening/DOCS-03-implementation.md b/linux_configuration/docs/security-hardening/DOCS-03-implementation.md index 686b4af7..4588f759 100644 --- a/linux_configuration/docs/security-hardening/DOCS-03-implementation.md +++ b/linux_configuration/docs/security-hardening/DOCS-03-implementation.md @@ -57,16 +57,10 @@ Changes needed: - Add input focus grabbing to prevent Alt+Tab escape - Disable window close keyboard shortcuts -## 4. PACMAN WRAPPER - Chrome Block + LeechBlock Auto-Install +## 4. PACMAN WRAPPER - LeechBlock Auto-Install Location: periodic_background/digital_wellbeing/pacman/ -Changes needed to pacman_blocked_keywords.txt: -- Add: google-chrome -- Add: google-chrome-stable -- Add: chromium -- Add: ungoogled-chromium - New behavior in pacman_wrapper.sh: - After ANY browser is detected installed (via pacman -Qq check): - Automatically run install_leechblock.sh if it exists @@ -166,7 +160,6 @@ Modified files: - hosts/guard/setup_hosts_guard.sh (add nsswitch protection) - periodic_background/digital_wellbeing/setup_midnight_shutdown.sh (remove helpful messages) -- periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt (add chrome) - periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh (leechblock auto-install) - periodic_background/digital_wellbeing/block_compulsive_opening.sh (auto-close timer) - periodic_background/digital_wellbeing/youtube-music-wrapper.sh (daemon integration) diff --git a/linux_configuration/docs/security-hardening/DOCS-04-agent-personas.md b/linux_configuration/docs/security-hardening/DOCS-04-agent-personas.md index df5e9a59..749f4a5d 100644 --- a/linux_configuration/docs/security-hardening/DOCS-04-agent-personas.md +++ b/linux_configuration/docs/security-hardening/DOCS-04-agent-personas.md @@ -85,27 +85,22 @@ FILES YOU KNOW: - periodic_background/digital_wellbeing/pacman/pacman_wrapper.sh - Main wrapper (823 lines) - periodic_background/digital_wellbeing/pacman/install_pacman_wrapper.sh - Backs up real pacman -- periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt - Always blocked -- periodic_background/digital_wellbeing/pacman/pacman_whitelist.txt - Exceptions to keywords -- periodic_background/digital_wellbeing/pacman/pacman_greylist.txt - Challenge required - periodic_background/digital_wellbeing/pacman/words.txt - Word scramble challenge words - /var/lib/pacman-wrapper/policy.sha256 - Integrity checksums KEY CONCEPTS: - Real pacman at /usr/bin/pacman.orig, wrapper symlinked to /usr/bin/pacman -- Policy integrity verification via SHA256 before ANY operation -- Three tiers: blocked (always denied), greylist (challenge), whitelist (bypass) -- VirtualBox check is HARDCODED (cannot bypass via policy files) +- Wrapper lib integrity verification via SHA256 before ANY operation +- Package policy lists (blocked/greylist/whitelist) were retired 2026-10-17; hosts/DNS blocking covers them +- VirtualBox check is HARDCODED (cannot bypass via wrapper libs) - Steam is weekend-only with word scramble challenge POLICY ENFORCEMENT: -1. Load policy lists from text files -2. Verify integrity hashes match -3. Check if package matches blocked keywords (unless whitelisted) -4. Check if greylisted (requires challenge) -5. After transaction, remove any blocked packages that got installed +1. Verify integrity hashes match +2. Apply the hardcoded checks (VirtualBox challenge, Steam weekend challenge) +3. Auto-install LeechBlock when a browser is installed HOSTS INTEGRATION: diff --git a/linux_configuration/docs/security-hardening/DOCS-05-llm-readmes.md b/linux_configuration/docs/security-hardening/DOCS-05-llm-readmes.md index 48aa63ce..cc3fefd7 100644 --- a/linux_configuration/docs/security-hardening/DOCS-05-llm-readmes.md +++ b/linux_configuration/docs/security-hardening/DOCS-05-llm-readmes.md @@ -68,14 +68,13 @@ Intercept pacman to enforce package installation policies. ```` -## Policy Files +## Files | File | Purpose | |------|---------| -| pacman_blocked_keywords.txt | Substring match = always blocked | -| pacman_whitelist.txt | Exact names that bypass blocking | -| pacman_greylist.txt | Requires challenge to install | | words.txt | Word scramble challenge source | +_Package policy lists (blocked keywords, whitelist, greylist) were retired 2026-10-17; hosts/DNS blocking covers them._ + ## Hardcoded Checks (cannot bypass via files) - VirtualBox → security challenge + hosts enforcement - Steam → weekend-only + word scramble @@ -85,11 +84,8 @@ Intercept pacman to enforce package installation policies. 2. Periodic maintenance (auto-setup if missing) 3. VirtualBox hosts enforcement -## Adding Blocks +## Updating the wrapper ```bash -# Edit the blocked keywords file -echo "newpackage" >> pacman_blocked_keywords.txt - # Re-run installer to update checksums sudo ./install_pacman_wrapper.sh ```` diff --git a/linux_configuration/docs/security-hardening/DOCS-06-test-template.md b/linux_configuration/docs/security-hardening/DOCS-06-test-template.md index e448391c..eaf23297 100644 --- a/linux_configuration/docs/security-hardening/DOCS-06-test-template.md +++ b/linux_configuration/docs/security-hardening/DOCS-06-test-template.md @@ -50,13 +50,6 @@ else test_result "pacman wrapper installed" "fail" fi -# Test 5: google-chrome is blocked -if grep -qi "google-chrome" ~/src/testsAndMisc/linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt; then - test_result "google-chrome in blocked list" "pass" -else - test_result "google-chrome in blocked list" "fail" -fi - # Summary echo "" echo "==========================================" @@ -75,6 +68,6 @@ This analysis identifies critical vulnerabilities and provides a comprehensive i 1. **nsswitch.conf bypass** - Completely unprotected, defeats all hosts protections 2. **Information disclosure** - Shutdown system tells users how to bypass 3. **App lifetime** - Compulsive blockers don't limit session duration -4. **Browser gaps** - Chrome not blocked, no LeechBlock auto-install +4. **Browser gaps** - no LeechBlock auto-install The implementation prompt above should be used in a focused coding session to address all issues systematically. diff --git a/linux_configuration/periodic_background/lib/services_browser.sh b/linux_configuration/periodic_background/lib/services_browser.sh index 72604954..908aab14 100755 --- a/linux_configuration/periodic_background/lib/services_browser.sh +++ b/linux_configuration/periodic_background/lib/services_browser.sh @@ -72,14 +72,12 @@ check_vbox_hosts() { local issues=() # Only check if VirtualBox is installed. - # This is NOT "skipped" in the sense of ducking a check: VirtualBox is absent - # AND deliberately blocked by pacman policy — pacman_blocked_keywords.txt lists - # virtualbox/vbox with the comment "can bypass /etc/hosts restrictions", which - # is the very thing this check enforces. With no VirtualBox there are no VMs to - # enforce /etc/hosts inside, so the check is genuinely not applicable. Report - # n/a so it reads as deliberate rather than something that got ducked. + # This is NOT "skipped" in the sense of ducking a check: with no VirtualBox + # there are no VMs to enforce /etc/hosts inside, so the check is genuinely not + # applicable. Report n/a so it reads as deliberate rather than something that + # got ducked. if ! command -v VBoxManage &>/dev/null; then - note "VirtualBox not installed (blocked by pacman policy) — not applicable" + note "VirtualBox not installed — not applicable" set_service_status "vbox_hosts" "n/a" return fi diff --git a/linux_configuration/periodic_background/lib/services_wrappers.sh b/linux_configuration/periodic_background/lib/services_wrappers.sh index bb37a109..b1a84b83 100755 --- a/linux_configuration/periodic_background/lib/services_wrappers.sh +++ b/linux_configuration/periodic_background/lib/services_wrappers.sh @@ -50,13 +50,11 @@ check_pacman_wrapper() { fi # Check supporting files - for file in words.txt pacman_blocked_keywords.txt pacman_whitelist.txt; do - if [[ -f "${SYSROOT}/usr/local/bin/$file" ]]; then - msg "Supporting file exists: ${SYSROOT}/usr/local/bin/$file" - else - warn "Supporting file missing: ${SYSROOT}/usr/local/bin/$file" - fi - done + if [[ -f "${SYSROOT}/usr/local/bin/words.txt" ]]; then + msg "Supporting file exists: ${SYSROOT}/usr/local/bin/words.txt" + else + warn "Supporting file missing: ${SYSROOT}/usr/local/bin/words.txt" + fi # Content drift — the check everything above misses. A correct symlink and a # present file say nothing about WHICH version is deployed. diff --git a/linux_configuration/periodic_background/lib/tests/test_services_wrappers.sh b/linux_configuration/periodic_background/lib/tests/test_services_wrappers.sh index ff953235..4a425267 100755 --- a/linux_configuration/periodic_background/lib/tests/test_services_wrappers.sh +++ b/linux_configuration/periodic_background/lib/tests/test_services_wrappers.sh @@ -23,8 +23,6 @@ stage_pacman_ok() { sysfile usr/bin/pacman.orig ln -sf "${SERVICES_ROOT}/usr/local/bin/pacman_wrapper" "${SERVICES_ROOT}/usr/bin/pacman" sysfile usr/local/bin/words.txt - sysfile usr/local/bin/pacman_blocked_keywords.txt - sysfile usr/local/bin/pacman_whitelist.txt (cd "${SERVICES_ROOT}" && sha256sum usr/local/bin/pacman_wrapper >"$PACMAN_WRAPPER_MANIFEST") } @@ -110,7 +108,7 @@ _t_called 'ran install_pacman_wrapper' "a missing .orig backup runs the installe echo "== check_pacman_wrapper: missing supporting files only warn ==" reset_state stage_pacman_ok -sysrm usr/local/bin/words.txt usr/local/bin/pacman_whitelist.txt +sysrm usr/local/bin/words.txt run_pacman_check >"${TEST_TMPDIR}/out.txt" _t_called_in "$(cat "${TEST_TMPDIR}/out.txt")" "Supporting file missing" "a missing supporting file is reported" _t_not_called 'ran install_pacman_wrapper' "but it does not trigger a reinstall"