mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 19:07:17 +01:00
Krzysztof kuhy Rudnicki
c99cb8373e
Extracts the chattr+bind-mount+systemd-watcher file-locking pattern (and a new pacman PreTransaction package-block primitive) out of screen-locker and steam-backlog-enforcer into a standalone, config-driven library so both projects (and steam-backlog-enforcer's new block-gaming feature) can share one implementation instead of maintaining parallel copies. - guardctl: CLI entry point (file-guard, package-block subcommands) - lib/file_guard.sh: chattr +i / bind-mount / systemd-path-watcher / pacman hook enforcement for a single target file, keyed by /etc/guard-lib/targets config; includes `sync` (adopt current content as canonical - for a caller's own legitimate edit) distinct from `pacman-relock` (revert drift) - lib/package_block.sh: time-locked pacman PreTransaction hook that refuses to (re)install a given package while a lock file's `until` timestamp is in the future; supports --bind-mount to compose with file-guard on the same lock file - pacman-hooks/: the installed hook scripts + .hook definitions - systemd/: guard-file@.path/.service watcher units, guard-bind-mount@.service Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFNiYQQgSLAkiBXswyimPq
24 lines
965 B
Bash
Executable File
24 lines
965 B
Bash
Executable File
#!/bin/bash
|
|
# PreTransaction hook script: quiet-unlock every registered file-guard
|
|
# instance so pacman can write through to files it legitimately manages
|
|
# (e.g. nsswitch.conf on a glibc upgrade, resolved.conf on a systemd
|
|
# upgrade). Deliberately never aborts: one broken instance config must not
|
|
# block every pacman transaction on the system, which is a much worse
|
|
# outcome than a guarded file briefly going unprotected mid-transaction
|
|
# (relock-all in PostTransaction restores it).
|
|
set -uo pipefail
|
|
|
|
TARGETS_DIR="${GUARD_LIB_TARGETS_DIR:-/etc/guard-lib/targets}"
|
|
GUARDCTL="${GUARD_LIB_BIN:-/usr/local/bin/guardctl}"
|
|
|
|
if [[ -d "$TARGETS_DIR" ]]; then
|
|
for conf in "$TARGETS_DIR"/*.conf; do
|
|
[[ -e "$conf" ]] || continue
|
|
name="$(basename "$conf" .conf)"
|
|
"$GUARDCTL" file-guard pacman-unlock "$name" 2>/dev/null || \
|
|
echo "guard-lib: WARNING failed to unlock '$name' before transaction (continuing)" >&2
|
|
done
|
|
fi
|
|
|
|
exit 0
|