1de5e86fed
Closes the tamper-evidence loop with two trust anchors the attacker can't forge from userland: - pkgdb Layer 2: verify on-disk files against the .MTREE in the *signed* cache package, surviving a rewritten local checksum DB. Rotating-sample cadence keeps it affordable; flags pkg_signature_mismatch (sid 100027) and SigLevel downgrades (sid 100026). Fixes parse_mtree, which required type=file on every line and so matched nothing on real pacman MTREEs (which use a /set type=file default with bare file entries). - rootcheck: anti-rootkit cross-view — hidden processes, modules, ports, and promiscuous interfaces, each caught by diffing two views of the same state (sids 100022-100025). Wired both through config, the daemon (off-loop slow cadence), and CLI (pkgdb-verify, rootcheck). 14 new tests (95 total). Docs + version bump. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
9 lines
361 B
Python
9 lines
361 B
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Enodia Sentinel — a host intrusion-detection daemon.
|
|
|
|
A poll-based HIDS that runs a set of detectors over live system state and
|
|
captures a forensic snapshot with incident-response guidance whenever a known
|
|
attack signature appears. The Python re-architecture of the bash v0 prototype.
|
|
"""
|
|
|
|
__version__ = "0.7.0"
|