Enodia Sentinel v0.1 — bash host-IDS prototype

Poll-based host intrusion-detection daemon modeled on freeze-watcher's
sample→trigger→snapshot→classify loop, with security signatures instead
of performance ones:

- reverse_shell  (interpreter with a network socket on stdio)
- ld_preload     (/etc/ld.so.preload or LD_PRELOAD in writable dirs)
- deleted_exe    (process running from a deleted/memfd binary)
- new_listener   (listening port absent from startup baseline)
- new_suid       (new SUID/SGID binary; critical in writable dirs)
- persistence    (cron/systemd/authorized_keys/rc-file changes)
- suspicious_egress (interpreter holding an outbound public connection)

Each capture writes a forensic snapshot with per-signature incident-
response guidance. Includes a safe, self-cleaning red-team harness
(sentinel-redteam), hardened systemd unit, config, Makefile, and Arch
packaging.

Tested on Arch: detectors fire on drills, no false positives on a clean
sweep, sweep cost optimized from ~15s to ~1s via batched syscalls and a
gated filesystem-wide SUID scan.

This bash implementation is retained as the regression oracle for the
forthcoming Python rewrite.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Makefile

@@ -0,0 +1,53 @@
+PREFIX        ?= /usr/local
+BINDIR        := $(PREFIX)/bin
+SYSTEMDDIR    := /etc/systemd/system
+CONFDIR       := /etc
+LOGDIR        := /var/log/enodia-sentinel
+
+.PHONY: install uninstall enable disable status logs check baseline drill clean
+
+install:
+	install -Dm755 src/sentinel.sh      $(DESTDIR)$(BINDIR)/sentinel.sh
+	install -Dm755 src/sentinel-redteam $(DESTDIR)$(BINDIR)/sentinel-redteam
+	install -Dm644 systemd/enodia-sentinel.service $(DESTDIR)$(SYSTEMDDIR)/enodia-sentinel.service
+	@if [ ! -e "$(DESTDIR)$(CONFDIR)/enodia-sentinel.conf" ]; then \
+		install -Dm644 config/enodia-sentinel.conf $(DESTDIR)$(CONFDIR)/enodia-sentinel.conf; \
+		echo "Installed default config at $(CONFDIR)/enodia-sentinel.conf"; \
+	else \
+		install -Dm644 config/enodia-sentinel.conf $(DESTDIR)$(CONFDIR)/enodia-sentinel.conf.new; \
+		echo "Existing config preserved; new template at $(CONFDIR)/enodia-sentinel.conf.new"; \
+	fi
+	install -dm750 $(DESTDIR)$(LOGDIR)
+	@echo "Installed. Run 'sudo make enable' to start the service."
+
+uninstall:
+	rm -f $(DESTDIR)$(BINDIR)/sentinel.sh
+	rm -f $(DESTDIR)$(BINDIR)/sentinel-redteam
+	rm -f $(DESTDIR)$(SYSTEMDDIR)/enodia-sentinel.service
+	rm -f $(DESTDIR)$(CONFDIR)/enodia-sentinel.conf.new
+	@echo "Uninstalled. Config and logs preserved."
+
+enable:
+	systemctl daemon-reload
+	systemctl enable --now enodia-sentinel.service
+
+disable:
+	systemctl disable --now enodia-sentinel.service
+
+status:
+	systemctl status enodia-sentinel.service --no-pager
+
+logs:
+	journalctl -u enodia-sentinel.service -f
+
+check:
+	sentinel.sh --check
+
+baseline:
+	sentinel.sh --baseline
+
+drill:
+	sentinel-redteam
+
+clean:
+	@echo "Nothing to clean (no build artifacts)."