mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 21:27:14 +01:00
Krzysztof kuhy Rudnicki
c99cb8373e
Extracts the chattr+bind-mount+systemd-watcher file-locking pattern (and a new pacman PreTransaction package-block primitive) out of screen-locker and steam-backlog-enforcer into a standalone, config-driven library so both projects (and steam-backlog-enforcer's new block-gaming feature) can share one implementation instead of maintaining parallel copies. - guardctl: CLI entry point (file-guard, package-block subcommands) - lib/file_guard.sh: chattr +i / bind-mount / systemd-path-watcher / pacman hook enforcement for a single target file, keyed by /etc/guard-lib/targets config; includes `sync` (adopt current content as canonical - for a caller's own legitimate edit) distinct from `pacman-relock` (revert drift) - lib/package_block.sh: time-locked pacman PreTransaction hook that refuses to (re)install a given package while a lock file's `until` timestamp is in the future; supports --bind-mount to compose with file-guard on the same lock file - pacman-hooks/: the installed hook scripts + .hook definitions - systemd/: guard-file@.path/.service watcher units, guard-bind-mount@.service Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFNiYQQgSLAkiBXswyimPq
45 lines
1.9 KiB
Bash
Executable File
45 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# Installs guard-lib: guardctl to /usr/local/bin, its lib/ to
|
|
# /usr/local/lib/guard-lib, systemd unit templates, and the generic
|
|
# unlock-all/relock-all pacman hooks. Safe to re-run (idempotent copy).
|
|
set -euo pipefail
|
|
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "install.sh must be run as root (it writes to /usr/local, /etc/systemd, /etc/pacman.d)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
for tool in jq chattr lsattr systemctl; do
|
|
command -v "$tool" >/dev/null 2>&1 || {
|
|
echo "install.sh: required tool '$tool' not found on PATH" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
echo "Installing guardctl to /usr/local/bin ..."
|
|
install -m 755 "$SCRIPT_DIR/guardctl" /usr/local/bin/guardctl
|
|
|
|
echo "Installing lib/ to /usr/local/lib/guard-lib ..."
|
|
install -d -m 755 /usr/local/lib/guard-lib
|
|
install -m 644 "$SCRIPT_DIR"/lib/*.sh /usr/local/lib/guard-lib/
|
|
|
|
echo "Installing systemd unit templates ..."
|
|
install -m 644 "$SCRIPT_DIR"/systemd/guard-file@.path /etc/systemd/system/
|
|
install -m 644 "$SCRIPT_DIR"/systemd/guard-file@.service /etc/systemd/system/
|
|
install -m 644 "$SCRIPT_DIR"/systemd/guard-bind-mount@.service /etc/systemd/system/
|
|
systemctl daemon-reload
|
|
|
|
echo "Installing generic pacman unlock-all/relock-all hooks ..."
|
|
install -d -m 755 /etc/guard-lib/pacman-hooks
|
|
install -m 755 "$SCRIPT_DIR/pacman-hooks/guard-lib-unlock-all.sh" /etc/guard-lib/pacman-hooks/
|
|
install -m 755 "$SCRIPT_DIR/pacman-hooks/guard-lib-relock-all.sh" /etc/guard-lib/pacman-hooks/
|
|
install -d -m 755 /etc/pacman.d/hooks
|
|
install -m 644 "$SCRIPT_DIR/pacman-hooks/10-guard-lib-unlock-all.hook" /etc/pacman.d/hooks/
|
|
install -m 644 "$SCRIPT_DIR/pacman-hooks/90-guard-lib-relock-all.hook" /etc/pacman.d/hooks/
|
|
|
|
install -d -m 755 /etc/guard-lib/targets /etc/guard-lib/blocks /etc/guard-lib/canonical
|
|
|
|
echo "guard-lib installed. Try: guardctl file-guard install dummy-test --target /etc/guard-test-file"
|