mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 20:07:04 +01:00
Krzysztof kuhy Rudnicki
4f2b0ccdf7
Two levels of pure taxonomy carrying no information, and a 2-directory
cap leaves no room for them. Categories now sit directly under
linux_configuration/: features, fixes, utils, misc, fresh-install,
installers, diagnostics, gaming, boot_recovery, periodic_background, lib,
meta, tests. A script's own lib/ and tests/ are exempt from the cap, so
those stay put.
Depth violations 248 -> 139; roughly 40 of the remainder are inside
digital_wellbeing and hosts, deferred until the guard-lib repoint.
The moves are the easy half. What breaks is every path that counted
levels, and three classes of it had to be found by resolving paths rather
than reading diffs:
- 52 relative `source` lines for lib/common.sh and lib/android.sh. The
correct prefix differs per file: 40 were ../../ and 12 were ../../../,
so a blanket replace would have fixed one set and broken the other.
- REPO_ROOT in 7 fixes/lib/tests harnesses and setup_syncyomi_guard.sh,
each walking up four levels from a directory now two levels shallower.
This caused a real regression -- the fixes suite went red with
"log_warn: command not found" -- caught by running it and comparing
against the pre-move baseline worktree.
- conftest.py's sys.path entries, which took the pytest gate down with
14 collection errors, and the `# shellcheck source=` directives, which
took shellcheck down with SC1091.
16 symlinks in $HOME broke, including the entire i3blocks bar. All
repointed, and cpu_monitor/memory/disk/time/volume were run to confirm
they emit real output rather than merely resolving.
Verified: 1798 tests pass at 100% coverage, 8 of 9 lib/tests suites pass
(the ninth needs the coverage jail, identically at baseline), pre-commit
is clean, and the two untracked secret configs are still ignored after
their gitignore paths changed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
98 lines
2.6 KiB
Markdown
98 lines
2.6 KiB
Markdown
# Testing, usage and design philosophy
|
|
|
|
## Testing
|
|
|
|
Run the test suite:
|
|
|
|
```bash
|
|
bash tests/test_pacman_wrapper_security.sh
|
|
```
|
|
|
|
Tests verify:
|
|
|
|
- Script syntax validity
|
|
- Integrity check function exists and is called
|
|
- Hardcoded VirtualBox check exists
|
|
- VirtualBox challenge function exists
|
|
- Immutable file attributes are set
|
|
- VirtualBox enforcement integration
|
|
|
|
## Usage
|
|
|
|
### Installation
|
|
|
|
```bash
|
|
cd periodic_background/digital_wellbeing/pacman
|
|
sudo ./install_pacman_wrapper.sh
|
|
```
|
|
|
|
This will:
|
|
|
|
- Install the wrapper and policy files
|
|
- Generate integrity checksums
|
|
- Make policy files immutable
|
|
- Install VirtualBox enforcement script
|
|
|
|
### Updating Policy Files
|
|
|
|
If you need to legitimately update policy files:
|
|
|
|
```bash
|
|
# Remove immutable attribute
|
|
sudo chattr -i /usr/local/bin/pacman_blocked_keywords.txt
|
|
sudo chattr -i /usr/local/bin/pacman_greylist.txt
|
|
|
|
# Edit files as needed
|
|
sudo nano /usr/local/bin/pacman_greylist.txt
|
|
|
|
# Reinstall wrapper to update checksums
|
|
cd periodic_background/digital_wellbeing/pacman
|
|
sudo ./install_pacman_wrapper.sh
|
|
|
|
# This will regenerate checksums and reapply immutable attributes
|
|
```
|
|
|
|
### VirtualBox Enforcement
|
|
|
|
After installing VirtualBox, the wrapper will automatically apply enforcement. You can also manually run:
|
|
|
|
```bash
|
|
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh enforce
|
|
```
|
|
|
|
For VM guests, copy the generated script and add to startup:
|
|
|
|
```bash
|
|
# On host
|
|
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh generate-script /tmp/vbox_sync.sh
|
|
|
|
# Copy to VM and install
|
|
sudo cp /tmp/vbox_sync.sh /usr/local/bin/
|
|
sudo chmod +x /usr/local/bin/vbox_sync.sh
|
|
|
|
# Add to crontab or systemd
|
|
@reboot /usr/local/bin/vbox_sync.sh
|
|
```
|
|
|
|
## Design Philosophy
|
|
|
|
These enhancements follow the principle of **defense in depth**:
|
|
|
|
- **Layer 1**: Immutable policy files (prevents casual editing)
|
|
- **Layer 2**: Integrity checksums (detects tampering)
|
|
- **Layer 3**: Hardcoded restrictions (cannot bypass via files)
|
|
- **Layer 4**: VirtualBox enforcement (prevents VM bypass)
|
|
- **Layer 5**: Psychological friction (word challenges, delays)
|
|
|
|
Each layer adds difficulty, making circumvention progressively harder while maintaining usability for legitimate use.
|
|
|
|
## Future Enhancements
|
|
|
|
Potential improvements:
|
|
|
|
1. **Digital signatures**: Sign the wrapper script itself to detect modifications
|
|
2. **Remote policy updates**: Fetch policy files from a trusted source
|
|
3. **Logging**: Log all wrapper invocations and challenges to detect patterns
|
|
4. **Time-based restrictions**: Different rules for different times/days
|
|
5. **Multi-factor challenges**: Combine word challenges with other verification methods
|