From 6fd3b44e8c06fe8b8b31a01c8187e2ad88012473 Mon Sep 17 00:00:00 2001 From: Krzysztof kuhy Rudnicki Date: Sun, 23 Aug 2026 15:29:14 +0200 Subject: [PATCH] vmbox: close the last open item -- reset clears chattr +i Item 5 was recorded as "PASS (partial, reset check pending)". Now verified: `chattr +i /etc/hosts` in a sandbox gives `----i-----------------`; after `vm reset` the same file reads `----------------------` and accepts a write. Worth having measured rather than assumed. Immutability is exactly what makes the hosts guard hard to undo on a real machine -- `rm` fails EPERM -- so "reset discards it wholesale" is the strongest form of the reset guarantee and the one most worth being sure of. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014wfxvsYxKM5xDXoDbkKi5u --- vmbox/SESSION_RESULTS.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/vmbox/SESSION_RESULTS.md b/vmbox/SESSION_RESULTS.md index 59657db..8e3bfb2 100644 --- a/vmbox/SESSION_RESULTS.md +++ b/vmbox/SESSION_RESULTS.md @@ -38,9 +38,16 @@ sh aborts the shell even with `|| true` (special-builtin rule). never installs guard-lib first, so on a fresh machine the core "Midnight shutdown timer" module always fails. -## Item 5: hosts guard immutability — PASS (partial, reset check pending) +## Item 5: hosts guard immutability — PASS (complete) lsattr /etc/hosts in the guest: ----ia---------------- (189366 entries). -The immutable flag really lands. `vm reset` clearing it still to verify. +The immutable flag really lands. + +`vm reset` clearing it: VERIFIED 2026-08-22 (was left pending). Set +`chattr +i /etc/hosts` in a sandbox -> `----i-----------------`; after +`vm reset` the same file reads `----------------------` AND accepts a write +(`echo test >> /etc/hosts` succeeds). This is the strongest form of the reset +guarantee: immutability is precisely what makes these scripts hard to undo on +a real machine, and the overlay discards it wholesale. ## Item 4: boot_recovery/install.sh — PASS (highest-value item) Installer exits 0; installs boot-repair + both pacman hooks.