34bc09041a
Answers two hard questions: "what guards the hashes FIM trusts?" and "how do we make the sensor itself hard to silently disable?" — within the honest limit that a root attacker who shares your privileges can't be fully stopped on-box, only made loud. - pkgdb.py: guards the package DB that `pacman -Qkk` trusts. Anchors a fingerprint of /var/lib/pacman/local (refreshed ONLY by the pacman hook) and cross-checks pacman.log; a DB change with no logged transaction is flagged pkgdb_tamper (CRITICAL, sid 100021) — catches an attacker rewriting a stored checksum to mask a modified binary. Verified end-to-end against a simulated hash-overwrite. - selfprotect.py: Sentinel's own binaries/config/units/hook are always in the FIM watch set (self-integrity); a heartbeat is written each loop; an external `watchdog` command polls a remote dashboard and pushes if the sensor goes silent or unreachable — silence becomes the alarm. - daemon: heartbeat + slow-cadence pkgdb check; DB anchor re-anchored in build_fim_baseline so the pacman hook refreshes it after each transaction - web: /api/status now reports heartbeat_age/stale; dashboard shows it - cli: pkgdb-check, watchdog (--url/--token/--max-age, bypasses min-severity) - config: pkgdb_verify/_interval, heartbeat_max_age - README: threat model (trust-anchor problem) + hardening layers (immutability, signed-package + external anchor); reframes "anti-rootkit" as tamper-evidence - tests: +8 (DB fingerprint, anchor/transaction logic, pacman.log parse, heartbeat + watchdog verdicts). 80/80 pass Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
30 lines
1.5 KiB
Bash
30 lines
1.5 KiB
Bash
# Maintainer: Enodia
|
|
pkgname=enodia-sentinel
|
|
pkgver=0.6.0
|
|
pkgrel=1
|
|
pkgdesc="Host intrusion-detection daemon — signature-based detection of reverse shells, LD_PRELOAD rootkits, fileless malware, and persistence tampering"
|
|
arch=('any')
|
|
url="https://github.com/Enodia/enodia-sentinel"
|
|
license=('GPL-3.0-or-later')
|
|
depends=('python>=3.11' 'iproute2' 'procps-ng')
|
|
optdepends=('python-bpfcc: eBPF event-driven execve monitor (catches short-lived processes)'
|
|
'bpftrace: execve tracing of short-lived processes in snapshots'
|
|
'libnotify: desktop notifications on alert')
|
|
backup=('etc/enodia-sentinel.toml')
|
|
source=()
|
|
sha256sums=()
|
|
|
|
package() {
|
|
cd "$startdir/.."
|
|
# Install the stdlib-only package as a directory + launcher under /usr.
|
|
install -d "$pkgdir/usr/lib/enodia-sentinel"
|
|
cp -r enodia_sentinel "$pkgdir/usr/lib/enodia-sentinel/"
|
|
install -Dm755 packaging/enodia-sentinel.wrapper "$pkgdir/usr/bin/enodia-sentinel"
|
|
install -Dm755 src/sentinel-redteam "$pkgdir/usr/bin/sentinel-redteam"
|
|
install -Dm644 systemd/enodia-sentinel.service "$pkgdir/usr/lib/systemd/system/enodia-sentinel.service"
|
|
install -Dm644 systemd/enodia-sentinel-web.service "$pkgdir/usr/lib/systemd/system/enodia-sentinel-web.service"
|
|
install -Dm644 packaging/enodia-sentinel-fim.hook "$pkgdir/usr/share/libalpm/hooks/enodia-sentinel-fim.hook"
|
|
install -Dm644 config/enodia-sentinel.toml "$pkgdir/etc/enodia-sentinel.toml"
|
|
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
|
|
install -dm750 "$pkgdir/var/log/enodia-sentinel"
|
|
}
|