mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 20:07:04 +01:00

Krzysztof kuhy Rudnicki 49d82511c3 Adopt the four markdown namespaces and gate them

Renames this repo's markdown onto README.md / CLAUDE*.md / DOCS*.md /
TODO*.md so a future session can tell a live task from a finished
record without reading the file to find out.

TODO files carry the literal "REMOVE ME AFTER FINISH" and are deleted
when the work lands. Enforced by the md-naming pre-commit hook and CI
workflow, both delegating to the shared gate in kuhyx/utils so this
repo's idea of a valid name cannot drift from every other repo's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A47aX5DJwmA3QFn3pkEWi7

2026-08-24 15:55:46 +02:00

2.6 KiB

Raw Blame History

Testing, usage and design philosophy

Testing

Run the test suite:

bash tests/test_pacman_wrapper_security.sh

Tests verify:

Script syntax validity
Integrity check function exists and is called
Hardcoded VirtualBox check exists
VirtualBox challenge function exists
Immutable file attributes are set
VirtualBox enforcement integration

Usage

Installation

cd periodic_background/digital_wellbeing/pacman
sudo ./install_pacman_wrapper.sh

This will:

Install the wrapper and policy files
Generate integrity checksums
Make policy files immutable
Install VirtualBox enforcement script

Updating Policy Files

If you need to legitimately update policy files:

# Remove immutable attribute
sudo chattr -i /usr/local/bin/pacman_blocked_keywords.txt
sudo chattr -i /usr/local/bin/pacman_greylist.txt

# Edit files as needed
sudo nano /usr/local/bin/pacman_greylist.txt

# Reinstall wrapper to update checksums
cd periodic_background/digital_wellbeing/pacman
sudo ./install_pacman_wrapper.sh

# This will regenerate checksums and reapply immutable attributes

VirtualBox Enforcement

After installing VirtualBox, the wrapper will automatically apply enforcement. You can also manually run:

sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh enforce

For VM guests, copy the generated script and add to startup:

# On host
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh generate-script /tmp/vbox_sync.sh

# Copy to VM and install
sudo cp /tmp/vbox_sync.sh /usr/local/bin/
sudo chmod +x /usr/local/bin/vbox_sync.sh

# Add to crontab or systemd
@reboot /usr/local/bin/vbox_sync.sh

Design Philosophy

These enhancements follow the principle of defense in depth:

Layer 1: Immutable policy files (prevents casual editing)
Layer 2: Integrity checksums (detects tampering)
Layer 3: Hardcoded restrictions (cannot bypass via files)
Layer 4: VirtualBox enforcement (prevents VM bypass)
Layer 5: Psychological friction (word challenges, delays)

Each layer adds difficulty, making circumvention progressively harder while maintaining usability for legitimate use.

Future Enhancements

Potential improvements:

Digital signatures: Sign the wrapper script itself to detect modifications
Remote policy updates: Fetch policy files from a trusted source
Logging: Log all wrapper invocations and challenges to detect patterns
Time-based restrictions: Different rules for different times/days
Multi-factor challenges: Combine word challenges with other verification methods

2.6 KiB Raw Blame History