mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 22:27:01 +01:00

Krzysztof kuhy Rudnicki ad46fc85a5 pacman wrapper: drop list-file checks and docs after list retirement

digital-wellbeing e2a7176 removed the blocked-keyword, white and grey
lists. check_pacman_wrapper no longer looks for them, the VirtualBox note
stops citing pacman policy, and the docs drop the lists and greylist
challenge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Lhzv7c391mTKWfwU17V7Z

2026-10-17 18:46:17 +02:00

2.5 KiB

Raw Blame History

Testing, usage and design philosophy

Testing

Run the test suite:

bash tests/test_pacman_wrapper_security.sh

Tests verify:

Script syntax validity
Integrity check function exists and is called
Hardcoded VirtualBox check exists
VirtualBox challenge function exists
Immutable file attributes are set
VirtualBox enforcement integration

Usage

Installation

cd periodic_background/digital_wellbeing/pacman
sudo ./install_pacman_wrapper.sh

This will:

Install the wrapper and wrapper libs
Generate integrity checksums
Make the lock lib immutable
Install VirtualBox enforcement script

Updating Wrapper Libs

If you need to legitimately update wrapper libs:

# Remove immutable attribute
sudo chattr -i /usr/local/bin/pacman_lock_lib.sh

# Edit files as needed
sudo nano /usr/local/bin/pacman_lock_lib.sh

# Reinstall wrapper to update checksums
cd periodic_background/digital_wellbeing/pacman
sudo ./install_pacman_wrapper.sh

# This will regenerate checksums and reapply immutable attributes

VirtualBox Enforcement

After installing VirtualBox, the wrapper will automatically apply enforcement. You can also manually run:

sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh enforce

For VM guests, copy the generated script and add to startup:

# On host
sudo /usr/local/share/digital_wellbeing/virtualbox/enforce_vbox_hosts.sh generate-script /tmp/vbox_sync.sh

# Copy to VM and install
sudo cp /tmp/vbox_sync.sh /usr/local/bin/
sudo chmod +x /usr/local/bin/vbox_sync.sh

# Add to crontab or systemd
@reboot /usr/local/bin/vbox_sync.sh

Design Philosophy

These enhancements follow the principle of defense in depth:

Layer 1: Immutable lock lib (prevents casual editing)
Layer 2: Integrity checksums (detects tampering)
Layer 3: Hardcoded restrictions (cannot bypass via files)
Layer 4: VirtualBox enforcement (prevents VM bypass)
Layer 5: Psychological friction (word challenges, delays)

Each layer adds difficulty, making circumvention progressively harder while maintaining usability for legitimate use.

Future Enhancements

Potential improvements:

Digital signatures: Sign the wrapper script itself to detect modifications
Remote updates: Fetch wrapper libs from a trusted source
Logging: Log all wrapper invocations and challenges to detect patterns
Time-based restrictions: Different rules for different times/days
Multi-factor challenges: Combine word challenges with other verification methods

2.5 KiB Raw Blame History