mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-12 20:10:53 +01:00
Krzysztof kuhy Rudnicki
ad46fc85a5
digital-wellbeing e2a7176 removed the blocked-keyword, white and grey lists. check_pacman_wrapper no longer looks for them, the VirtualBox note stops citing pacman policy, and the docs drop the lists and greylist challenge. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Lhzv7c391mTKWfwU17V7Z
97 lines
2.5 KiB
Markdown
97 lines
2.5 KiB
Markdown
# Testing, usage and design philosophy
|
|
|
|
## Testing
|
|
|
|
Run the test suite:
|
|
|
|
```bash
|
|
bash tests/test_pacman_wrapper_security.sh
|
|
```
|
|
|
|
Tests verify:
|
|
|
|
- Script syntax validity
|
|
- Integrity check function exists and is called
|
|
- Hardcoded VirtualBox check exists
|
|
- VirtualBox challenge function exists
|
|
- Immutable file attributes are set
|
|
- VirtualBox enforcement integration
|
|
|
|
## Usage
|
|
|
|
### Installation
|
|
|
|
```bash
|
|
cd periodic_background/digital_wellbeing/pacman
|
|
sudo ./install_pacman_wrapper.sh
|
|
```
|
|
|
|
This will:
|
|
|
|
- Install the wrapper and wrapper libs
|
|
- Generate integrity checksums
|
|
- Make the lock lib immutable
|
|
- Install VirtualBox enforcement script
|
|
|
|
### Updating Wrapper Libs
|
|
|
|
If you need to legitimately update wrapper libs:
|
|
|
|
```bash
|
|
# Remove immutable attribute
|
|
sudo chattr -i /usr/local/bin/pacman_lock_lib.sh
|
|
|
|
# Edit files as needed
|
|
sudo nano /usr/local/bin/pacman_lock_lib.sh
|
|
|
|
# Reinstall wrapper to update checksums
|
|
cd periodic_background/digital_wellbeing/pacman
|
|
sudo ./install_pacman_wrapper.sh
|
|
|
|
# This will regenerate checksums and reapply immutable attributes
|
|
```
|
|
|
|
### VirtualBox Enforcement
|
|
|
|
After installing VirtualBox, the wrapper will automatically apply enforcement. You can also manually run:
|
|
|
|
```bash
|
|
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh enforce
|
|
```
|
|
|
|
For VM guests, copy the generated script and add to startup:
|
|
|
|
```bash
|
|
# On host
|
|
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh generate-script /tmp/vbox_sync.sh
|
|
|
|
# Copy to VM and install
|
|
sudo cp /tmp/vbox_sync.sh /usr/local/bin/
|
|
sudo chmod +x /usr/local/bin/vbox_sync.sh
|
|
|
|
# Add to crontab or systemd
|
|
@reboot /usr/local/bin/vbox_sync.sh
|
|
```
|
|
|
|
## Design Philosophy
|
|
|
|
These enhancements follow the principle of **defense in depth**:
|
|
|
|
- **Layer 1**: Immutable lock lib (prevents casual editing)
|
|
- **Layer 2**: Integrity checksums (detects tampering)
|
|
- **Layer 3**: Hardcoded restrictions (cannot bypass via files)
|
|
- **Layer 4**: VirtualBox enforcement (prevents VM bypass)
|
|
- **Layer 5**: Psychological friction (word challenges, delays)
|
|
|
|
Each layer adds difficulty, making circumvention progressively harder while maintaining usability for legitimate use.
|
|
|
|
## Future Enhancements
|
|
|
|
Potential improvements:
|
|
|
|
1. **Digital signatures**: Sign the wrapper script itself to detect modifications
|
|
2. **Remote updates**: Fetch wrapper libs from a trusted source
|
|
3. **Logging**: Log all wrapper invocations and challenges to detect patterns
|
|
4. **Time-based restrictions**: Different rules for different times/days
|
|
5. **Multi-factor challenges**: Combine word challenges with other verification methods
|