kuhyx/testsAndMisc
1
0
Fork 0
mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 18:07:06 +01:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
981823e3b9
testsAndMisc/linux_configuration/periodic_background/digital_wellbeing/llm-notes/vulns-and-troubleshooting.md
Krzysztof kuhy Rudnicki 4f2b0ccdf7 Dissolve linux_configuration/scripts/ and single_use/ 
Two levels of pure taxonomy carrying no information, and a 2-directory
cap leaves no room for them. Categories now sit directly under
linux_configuration/: features, fixes, utils, misc, fresh-install,
installers, diagnostics, gaming, boot_recovery, periodic_background, lib,
meta, tests. A script's own lib/ and tests/ are exempt from the cap, so
those stay put.

Depth violations 248 -> 139; roughly 40 of the remainder are inside
digital_wellbeing and hosts, deferred until the guard-lib repoint.

The moves are the easy half. What breaks is every path that counted
levels, and three classes of it had to be found by resolving paths rather
than reading diffs:

  - 52 relative `source` lines for lib/common.sh and lib/android.sh. The
    correct prefix differs per file: 40 were ../../ and 12 were ../../../,
    so a blanket replace would have fixed one set and broken the other.
  - REPO_ROOT in 7 fixes/lib/tests harnesses and setup_syncyomi_guard.sh,
    each walking up four levels from a directory now two levels shallower.
    This caused a real regression -- the fixes suite went red with
    "log_warn: command not found" -- caught by running it and comparing
    against the pre-move baseline worktree.
  - conftest.py's sys.path entries, which took the pytest gate down with
    14 collection errors, and the `# shellcheck source=` directives, which
    took shellcheck down with SC1091.

16 symlinks in $HOME broke, including the entire i3blocks bar. All
repointed, and cpu_monitor/memory/disk/time/volume were run to confirm
they emit real output rather than merely resolving.

Verified: 1798 tests pass at 100% coverage, 8 of 9 lib/tests suites pass
(the ninth needs the coverage jail, identically at baseline), pre-commit
is clean, and the two untracked secret configs are still ignored after
their gitignore paths changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJrqKERAo5QUeEHWS5Asgp
2026-08-23 18:53:30 +02:00

1.4 KiB
Raw Blame History

Known vulnerabilities, troubleshooting and hard stops

KNOWN VULNERABILITIES

  1. Information Disclosure: Error messages tell user exactly how to bypass
  2. Unlock Script Discoverable: Path mentioned in error messages
  3. Timer Monitor Killable: User can stop the monitor then the timer
  4. Check Script Unprotected: /usr/local/bin/day-specific-shutdown-check.sh can be edited

TODO:

  • Remove helpful bypass instructions from error messages
  • Rename unlock script to obscure name
  • Protect check script with integrity verification

Troubleshooting

Timer not firing

systemctl status day-specific-shutdown.timer
systemctl list-timers | grep shutdown

Config not being enforced

# Check path watcher
systemctl status shutdown-schedule-guard.path

# Manually trigger enforcement
sudo /usr/local/sbin/enforce-shutdown-schedule.sh

Wrong time shown in i3blocks

# Verify config
cat /etc/shutdown-schedule.conf

# Check i3blocks config
cat ~/.config/i3blocks/config | grep shutdown

DO NOT

  1. ❌ Edit setup script constants to make schedule later (will be blocked)
  2. ❌ Delete canonical config (breaks restoration)
  3. ❌ Stop shutdown-timer-monitor.service (timer will be re-enabled anyway)
  4. ❌ Modify check script to skip shutdown (defeats purpose)
  5. ❌ Lower MORNING_END_HOUR (always blocked, shortens shutdown window)