Enodia Sentinel v0.1 — bash host-IDS prototype

Poll-based host intrusion-detection daemon modeled on freeze-watcher's
sample→trigger→snapshot→classify loop, with security signatures instead
of performance ones:

- reverse_shell  (interpreter with a network socket on stdio)
- ld_preload     (/etc/ld.so.preload or LD_PRELOAD in writable dirs)
- deleted_exe    (process running from a deleted/memfd binary)
- new_listener   (listening port absent from startup baseline)
- new_suid       (new SUID/SGID binary; critical in writable dirs)
- persistence    (cron/systemd/authorized_keys/rc-file changes)
- suspicious_egress (interpreter holding an outbound public connection)

Each capture writes a forensic snapshot with per-signature incident-
response guidance. Includes a safe, self-cleaning red-team harness
(sentinel-redteam), hardened systemd unit, config, Makefile, and Arch
packaging.

Tested on Arch: detectors fire on drills, no false positives on a clean
sweep, sweep cost optimized from ~15s to ~1s via batched syscalls and a
gated filesystem-wide SUID scan.

This bash implementation is retained as the regression oracle for the
forthcoming Python rewrite.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

systemd/enodia-sentinel.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=Enodia Sentinel - host intrusion detection daemon
+After=network.target
+Documentation=https://github.com/Enodia/enodia-sentinel
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/sentinel.sh
+Restart=on-failure
+RestartSec=5
+
+# Needs to read every process's /proc, sockets, and SUID inventory, so it runs
+# as root — but with the surface area locked down. It only ever READS the system
+# and WRITES to its own log dir.
+ProtectSystem=strict
+ReadWritePaths=/var/log/enodia-sentinel
+ProtectHome=read-only
+NoNewPrivileges=yes
+ProtectKernelTunables=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+MemoryDenyWriteExecute=yes
+LockPersonality=yes
+# CAP_SYS_PTRACE: read other processes' /proc; CAP_DAC_READ_SEARCH: read
+# root-owned files (authorized_keys, ld.so.preload) regardless of perms.
+AmbientCapabilities=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH
+
+[Install]
+WantedBy=multi-user.target