testsAndMisc/DOCS-06-test-template.md at f15f00f3fed366bc45b9be4259cff17a85c71361

mirror of https://github.com/kuhyx/testsAndMisc.git synced 2026-11-10 18:07:06 +01:00

Krzysztof kuhy Rudnicki f15f00f3fe Re-point paths for the ~ reorganisation (home-tidy)

Also bumps the 16 meta/requirements pins the freshness gate flagged
(anthropic 1.5.0, numpy 2.5.3, pytest-randomly 5, flake8-bugbear 26.9.9,
ruff 0.16.7, pyright 1.1.414, selenium 4.49.0, hypothesis 6.168.0, lxml
6.1.3, pipdeptree 4.2.5, the two types-* stubs) and Flutter 3.47.3 in
meta/.fvmrc. One test still expected the pre-move ~/mcp-servers path.

The pre-commit hook fed .zsh files to shfmt and shellcheck, neither of
which parses zsh (SC2148/SC1071), so no zsh file could be committed since
the hook was tightened on 2026-08-22; those now get `zsh -n` instead. The
hook's own shfmt pass also staged its reformat of 8 shell files.

CI_GREEN_SKIP because main is red on exactly the dependency-freshness
finding this commit fixes, which is the documented use of that flag.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AwtowrowDXx6ccmWVPkCaF

2026-09-11 20:50:19 +02:00

2.3 KiB

Raw Blame History

Part 6: Test Script Template

#!/bin/bash
# tests/test_security_hardening.sh
# Verify all security mechanisms are working

set -euo pipefail

PASS=0
FAIL=0

test_result() {
    local name="$1"
    local result="$2"
    if [[ $result == "pass" ]]; then
        echo "✅ PASS: $name"
        ((PASS++))
    else
        echo "❌ FAIL: $name"
        ((FAIL++))
    fi
}

# Test 1: /etc/hosts is immutable
if lsattr /etc/hosts 2>/dev/null | grep -q '^....i'; then
    test_result "/etc/hosts is immutable" "pass"
else
    test_result "/etc/hosts is immutable" "fail"
fi

# Test 2: hosts-guard.path is active
if systemctl is-active --quiet hosts-guard.path; then
    test_result "hosts-guard.path is active" "pass"
else
    test_result "hosts-guard.path is active" "fail"
fi

# Test 3: shutdown-schedule.conf is immutable
if lsattr /etc/shutdown-schedule.conf 2>/dev/null | grep -q '^....i'; then
    test_result "/etc/shutdown-schedule.conf is immutable" "pass"
else
    test_result "/etc/shutdown-schedule.conf is immutable" "fail"
fi

# Test 4: pacman wrapper is installed
if [[ -L /usr/bin/pacman ]] && [[ -f /usr/bin/pacman.orig ]]; then
    test_result "pacman wrapper installed" "pass"
else
    test_result "pacman wrapper installed" "fail"
fi

# Test 5: google-chrome is blocked
if grep -qi "google-chrome" ~/src/testsAndMisc/linux_configuration/scripts/periodic_background/digital_wellbeing/pacman/pacman_blocked_keywords.txt; then
    test_result "google-chrome in blocked list" "pass"
else
    test_result "google-chrome in blocked list" "fail"
fi

# Summary
echo ""
echo "=========================================="
echo "Results: $PASS passed, $FAIL failed"
echo "=========================================="

exit $FAIL

Conclusion

This analysis identifies critical vulnerabilities and provides a comprehensive implementation prompt. The most urgent issues are:

nsswitch.conf bypass - Completely unprotected, defeats all hosts protections
Information disclosure - Shutdown system tells users how to bypass
App lifetime - Compulsive blockers don't limit session duration
Browser gaps - Chrome not blocked, no LeechBlock auto-install

The implementation prompt above should be used in a focused coding session to address all issues systematically.

2.3 KiB Raw Blame History

Part 6: Test Script Template

Conclusion

2.3 KiB

Raw Blame History