mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 12:27:50 +01:00
Krzysztof kuhy Rudnicki
49d82511c3
Renames this repo's markdown onto README.md / CLAUDE*.md / DOCS*.md / TODO*.md so a future session can tell a live task from a finished record without reading the file to find out. TODO files carry the literal "REMOVE ME AFTER FINISH" and are deleted when the work lands. Enforced by the md-naming pre-commit hook and CI workflow, both delegating to the shared gate in kuhyx/utils so this repo's idea of a valid name cannot drift from every other repo's. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A47aX5DJwmA3QFn3pkEWi7
81 lines
2.2 KiB
Markdown
81 lines
2.2 KiB
Markdown
## Part 6: Test Script Template
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
# tests/test_security_hardening.sh
|
|
# Verify all security mechanisms are working
|
|
|
|
set -euo pipefail
|
|
|
|
PASS=0
|
|
FAIL=0
|
|
|
|
test_result() {
|
|
local name="$1"
|
|
local result="$2"
|
|
if [[ $result == "pass" ]]; then
|
|
echo "✅ PASS: $name"
|
|
((PASS++))
|
|
else
|
|
echo "❌ FAIL: $name"
|
|
((FAIL++))
|
|
fi
|
|
}
|
|
|
|
# Test 1: /etc/hosts is immutable
|
|
if lsattr /etc/hosts 2>/dev/null | grep -q '^....i'; then
|
|
test_result "/etc/hosts is immutable" "pass"
|
|
else
|
|
test_result "/etc/hosts is immutable" "fail"
|
|
fi
|
|
|
|
# Test 2: hosts-guard.path is active
|
|
if systemctl is-active --quiet hosts-guard.path; then
|
|
test_result "hosts-guard.path is active" "pass"
|
|
else
|
|
test_result "hosts-guard.path is active" "fail"
|
|
fi
|
|
|
|
# Test 3: shutdown-schedule.conf is immutable
|
|
if lsattr /etc/shutdown-schedule.conf 2>/dev/null | grep -q '^....i'; then
|
|
test_result "/etc/shutdown-schedule.conf is immutable" "pass"
|
|
else
|
|
test_result "/etc/shutdown-schedule.conf is immutable" "fail"
|
|
fi
|
|
|
|
# Test 4: pacman wrapper is installed
|
|
if [[ -L /usr/bin/pacman ]] && [[ -f /usr/bin/pacman.orig ]]; then
|
|
test_result "pacman wrapper installed" "pass"
|
|
else
|
|
test_result "pacman wrapper installed" "fail"
|
|
fi
|
|
|
|
# Test 5: google-chrome is blocked
|
|
if grep -qi "google-chrome" ~/linux-configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt; then
|
|
test_result "google-chrome in blocked list" "pass"
|
|
else
|
|
test_result "google-chrome in blocked list" "fail"
|
|
fi
|
|
|
|
# Summary
|
|
echo ""
|
|
echo "=========================================="
|
|
echo "Results: $PASS passed, $FAIL failed"
|
|
echo "=========================================="
|
|
|
|
exit $FAIL
|
|
```
|
|
|
|
---
|
|
|
|
## Conclusion
|
|
|
|
This analysis identifies critical vulnerabilities and provides a comprehensive implementation prompt. The most urgent issues are:
|
|
|
|
1. **nsswitch.conf bypass** - Completely unprotected, defeats all hosts protections
|
|
2. **Information disclosure** - Shutdown system tells users how to bypass
|
|
3. **App lifetime** - Compulsive blockers don't limit session duration
|
|
4. **Browser gaps** - Chrome not blocked, no LeechBlock auto-install
|
|
|
|
The implementation prompt above should be used in a focused coding session to address all issues systematically.
|