mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 18:54:03 +01:00
Krzysztof kuhy Rudnicki
346eb1f00b
Twelve prose violations to zero. Eight files split into per-topic subdirectories with the original left as an index; both SKILL.md files keep their frontmatter so discovery still works, with detail moved to references/. Deleted docs/cleanup-2026-05/ (7 files) and linux_configuration/docs/ VERIFICATION.md on the user's ruling: unreferenced records of finished work whose rules are now enforced by the polling, shellcheck and shfmt hooks. PACMAN_WRAPPER_SECURITY.md was split instead - unlike those, it documents live guarantees. Every split verified by a sorted diff against HEAD: zero content lines lost, only the new headings and index links added. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011w2Pj4Ek3ZNMQVYcFHgXDY
98 lines
2.6 KiB
Markdown
98 lines
2.6 KiB
Markdown
# Testing, usage and design philosophy
|
|
|
|
## Testing
|
|
|
|
Run the test suite:
|
|
|
|
```bash
|
|
bash tests/test_pacman_wrapper_security.sh
|
|
```
|
|
|
|
Tests verify:
|
|
|
|
- Script syntax validity
|
|
- Integrity check function exists and is called
|
|
- Hardcoded VirtualBox check exists
|
|
- VirtualBox challenge function exists
|
|
- Immutable file attributes are set
|
|
- VirtualBox enforcement integration
|
|
|
|
## Usage
|
|
|
|
### Installation
|
|
|
|
```bash
|
|
cd scripts/periodic_background/digital_wellbeing/pacman
|
|
sudo ./install_pacman_wrapper.sh
|
|
```
|
|
|
|
This will:
|
|
|
|
- Install the wrapper and policy files
|
|
- Generate integrity checksums
|
|
- Make policy files immutable
|
|
- Install VirtualBox enforcement script
|
|
|
|
### Updating Policy Files
|
|
|
|
If you need to legitimately update policy files:
|
|
|
|
```bash
|
|
# Remove immutable attribute
|
|
sudo chattr -i /usr/local/bin/pacman_blocked_keywords.txt
|
|
sudo chattr -i /usr/local/bin/pacman_greylist.txt
|
|
|
|
# Edit files as needed
|
|
sudo nano /usr/local/bin/pacman_greylist.txt
|
|
|
|
# Reinstall wrapper to update checksums
|
|
cd scripts/periodic_background/digital_wellbeing/pacman
|
|
sudo ./install_pacman_wrapper.sh
|
|
|
|
# This will regenerate checksums and reapply immutable attributes
|
|
```
|
|
|
|
### VirtualBox Enforcement
|
|
|
|
After installing VirtualBox, the wrapper will automatically apply enforcement. You can also manually run:
|
|
|
|
```bash
|
|
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh enforce
|
|
```
|
|
|
|
For VM guests, copy the generated script and add to startup:
|
|
|
|
```bash
|
|
# On host
|
|
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh generate-script /tmp/vbox_sync.sh
|
|
|
|
# Copy to VM and install
|
|
sudo cp /tmp/vbox_sync.sh /usr/local/bin/
|
|
sudo chmod +x /usr/local/bin/vbox_sync.sh
|
|
|
|
# Add to crontab or systemd
|
|
@reboot /usr/local/bin/vbox_sync.sh
|
|
```
|
|
|
|
## Design Philosophy
|
|
|
|
These enhancements follow the principle of **defense in depth**:
|
|
|
|
- **Layer 1**: Immutable policy files (prevents casual editing)
|
|
- **Layer 2**: Integrity checksums (detects tampering)
|
|
- **Layer 3**: Hardcoded restrictions (cannot bypass via files)
|
|
- **Layer 4**: VirtualBox enforcement (prevents VM bypass)
|
|
- **Layer 5**: Psychological friction (word challenges, delays)
|
|
|
|
Each layer adds difficulty, making circumvention progressively harder while maintaining usability for legitimate use.
|
|
|
|
## Future Enhancements
|
|
|
|
Potential improvements:
|
|
|
|
1. **Digital signatures**: Sign the wrapper script itself to detect modifications
|
|
2. **Remote policy updates**: Fetch policy files from a trusted source
|
|
3. **Logging**: Log all wrapper invocations and challenges to detect patterns
|
|
4. **Time-based restrictions**: Different rules for different times/days
|
|
5. **Multi-factor challenges**: Combine word challenges with other verification methods
|