kuhyx/testsAndMisc
1
0
Fork 0
mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-11 21:54:00 +01:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
47b4510ac6
testsAndMisc/linux_configuration/docs/security-hardening/DOCS-06-test-template.md
Krzysztof kuhy Rudnicki ad46fc85a5 pacman wrapper: drop list-file checks and docs after list retirement 
digital-wellbeing e2a7176 removed the blocked-keyword, white and grey
lists. check_pacman_wrapper no longer looks for them, the VirtualBox note
stops citing pacman policy, and the docs drop the lists and greylist
challenge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Lhzv7c391mTKWfwU17V7Z
2026-10-17 18:46:17 +02:00

1.9 KiB
Raw Blame History

Part 6: Test Script Template

#!/bin/bash
# tests/test_security_hardening.sh
# Verify all security mechanisms are working

set -euo pipefail

PASS=0
FAIL=0

test_result() {
    local name="$1"
    local result="$2"
    if [[ $result == "pass" ]]; then
        echo "✅ PASS: $name"
        ((PASS++))
    else
        echo "❌ FAIL: $name"
        ((FAIL++))
    fi
}

# Test 1: /etc/hosts is immutable
if lsattr /etc/hosts 2>/dev/null | grep -q '^....i'; then
    test_result "/etc/hosts is immutable" "pass"
else
    test_result "/etc/hosts is immutable" "fail"
fi

# Test 2: hosts-guard.path is active
if systemctl is-active --quiet hosts-guard.path; then
    test_result "hosts-guard.path is active" "pass"
else
    test_result "hosts-guard.path is active" "fail"
fi

# Test 3: shutdown-schedule.conf is immutable
if lsattr /etc/shutdown-schedule.conf 2>/dev/null | grep -q '^....i'; then
    test_result "/etc/shutdown-schedule.conf is immutable" "pass"
else
    test_result "/etc/shutdown-schedule.conf is immutable" "fail"
fi

# Test 4: pacman wrapper is installed
if [[ -L /usr/bin/pacman ]] && [[ -f /usr/bin/pacman.orig ]]; then
    test_result "pacman wrapper installed" "pass"
else
    test_result "pacman wrapper installed" "fail"
fi

# Summary
echo ""
echo "=========================================="
echo "Results: $PASS passed, $FAIL failed"
echo "=========================================="

exit $FAIL

Conclusion

This analysis identifies critical vulnerabilities and provides a comprehensive implementation prompt. The most urgent issues are:

  1. nsswitch.conf bypass - Completely unprotected, defeats all hosts protections
  2. Information disclosure - Shutdown system tells users how to bypass
  3. App lifetime - Compulsive blockers don't limit session duration
  4. Browser gaps - no LeechBlock auto-install

The implementation prompt above should be used in a focused coding session to address all issues systematically.