kuhyx/testsAndMisc
1
0
Fork 0
mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 22:07:03 +01:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
main
testsAndMisc/linux_configuration/docs/pacman-wrapper/DOCS-testing-and-usage.md
Krzysztof kuhy Rudnicki ad46fc85a5 pacman wrapper: drop list-file checks and docs after list retirement 
digital-wellbeing e2a7176 removed the blocked-keyword, white and grey
lists. check_pacman_wrapper no longer looks for them, the VirtualBox note
stops citing pacman policy, and the docs drop the lists and greylist
challenge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Lhzv7c391mTKWfwU17V7Z
2026-10-17 18:46:17 +02:00

2.5 KiB
Raw Permalink Blame History

Testing, usage and design philosophy

Testing

Run the test suite:

bash tests/test_pacman_wrapper_security.sh

Tests verify:

  • Script syntax validity
  • Integrity check function exists and is called
  • Hardcoded VirtualBox check exists
  • VirtualBox challenge function exists
  • Immutable file attributes are set
  • VirtualBox enforcement integration

Usage

Installation

cd periodic_background/digital_wellbeing/pacman
sudo ./install_pacman_wrapper.sh

This will:

  • Install the wrapper and wrapper libs
  • Generate integrity checksums
  • Make the lock lib immutable
  • Install VirtualBox enforcement script

Updating Wrapper Libs

If you need to legitimately update wrapper libs:

# Remove immutable attribute
sudo chattr -i /usr/local/bin/pacman_lock_lib.sh

# Edit files as needed
sudo nano /usr/local/bin/pacman_lock_lib.sh

# Reinstall wrapper to update checksums
cd periodic_background/digital_wellbeing/pacman
sudo ./install_pacman_wrapper.sh

# This will regenerate checksums and reapply immutable attributes

VirtualBox Enforcement

After installing VirtualBox, the wrapper will automatically apply enforcement. You can also manually run:

sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh enforce

For VM guests, copy the generated script and add to startup:

# On host
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh generate-script /tmp/vbox_sync.sh

# Copy to VM and install
sudo cp /tmp/vbox_sync.sh /usr/local/bin/
sudo chmod +x /usr/local/bin/vbox_sync.sh

# Add to crontab or systemd
@reboot /usr/local/bin/vbox_sync.sh

Design Philosophy

These enhancements follow the principle of defense in depth:

  • Layer 1: Immutable lock lib (prevents casual editing)
  • Layer 2: Integrity checksums (detects tampering)
  • Layer 3: Hardcoded restrictions (cannot bypass via files)
  • Layer 4: VirtualBox enforcement (prevents VM bypass)
  • Layer 5: Psychological friction (word challenges, delays)

Each layer adds difficulty, making circumvention progressively harder while maintaining usability for legitimate use.

Future Enhancements

Potential improvements:

  1. Digital signatures: Sign the wrapper script itself to detect modifications
  2. Remote updates: Fetch wrapper libs from a trusted source
  3. Logging: Log all wrapper invocations and challenges to detect patterns
  4. Time-based restrictions: Different rules for different times/days
  5. Multi-factor challenges: Combine word challenges with other verification methods