kuhyx/testsAndMisc
1
0
Fork 0
mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 20:27:02 +01:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
ad46fc85a5
testsAndMisc/linux_configuration/docs/security-hardening/DOCS-05-llm-readmes.md
Krzysztof kuhy Rudnicki ad46fc85a5 pacman wrapper: drop list-file checks and docs after list retirement 
digital-wellbeing e2a7176 removed the blocked-keyword, white and grey
lists. check_pacman_wrapper no longer looks for them, the VirtualBox note
stops citing pacman policy, and the docs drop the lists and greylist
challenge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Lhzv7c391mTKWfwU17V7Z
2026-10-17 18:46:17 +02:00

2.1 KiB
Raw Blame History

Part 5: LLM README Files

These should be created in the respective directories:

[hosts/guard/README_FOR_LLM.md](to be created)

# Hosts Guard System - LLM Reference

## Purpose

Prevent tampering with /etc/hosts to maintain website blocking.

## Architecture

/etc/hosts (immutable) ←── canonical (/usr/local/share/locked-hosts) ↑ path watcher detects changes ↓ enforce-hosts.sh restores


## Critical Files
| File | Purpose | Protected By |
|------|---------|--------------|
| /etc/hosts | Actual hosts file | chattr +i, bind mount |
| /usr/local/share/locked-hosts | Canonical copy | chattr +i |
| /etc/hosts.custom-entries.state | Tracks blocked domains | chattr +i |

## Commands to Know
```bash
# Check protection status
lsattr /etc/hosts
systemctl status hosts-guard.path hosts-bind-mount.service

# Legitimate edit (with delay)
sudo /usr/local/sbin/unlock-hosts

# Reinstall/repair
sudo ~/src/hosts-blocker/install.sh
sudo ~/src/hosts-blocker/guard/setup_hosts_guard.sh

DO NOT

  • Edit /etc/nsswitch.conf (bypasses hosts entirely)
  • Stop hosts-guard.path without understanding consequences
  • Remove entries from install.sh without state file cleanup

### [periodic_background/digital_wellbeing/pacman/README_FOR_LLM.md](to be created)

```markdown
# Pacman Wrapper - LLM Reference

## Purpose
Intercept pacman to enforce package installation policies.

## Architecture

/usr/bin/pacman (symlink) → pacman_wrapper.sh ↓ /usr/bin/pacman.orig (real)


## Files
| File | Purpose |
|------|---------|
| words.txt | Word scramble challenge source |

_Package policy lists (blocked keywords, whitelist, greylist) were retired 2026-10-17; hosts/DNS blocking covers them._

## Hardcoded Checks (cannot bypass via files)
- VirtualBox → security challenge + hosts enforcement
- Steam → weekend-only + word scramble

## Integration Points
1. Hosts guard (pre/post hooks)
2. Periodic maintenance (auto-setup if missing)
3. VirtualBox hosts enforcement

## Updating the wrapper
```bash
# Re-run installer to update checksums
sudo ./install_pacman_wrapper.sh