ghost
718 lines
29 KiB
Bash
Executable File
718 lines
29 KiB
Bash
Executable File
#!/bin/bash
|
|
# /usr/local/lib/opsec/opsec-lib.sh — Shared OPSEC function library
|
|
# Sourced by all OPSEC scripts for config management and common operations
|
|
|
|
OPSEC_CONF="/etc/opsec/opsec.conf"
|
|
OPSEC_COUNTRY_CODES="/etc/opsec/country-codes.conf"
|
|
OPSEC_PROFILES_DIR="/etc/opsec/profiles"
|
|
OPSEC_STATE_FILE="/var/run/opsec-advanced.enabled"
|
|
OPSEC_BOOT_MARKER="/etc/opsec/boot-advanced.enabled"
|
|
|
|
# ─── COLOR OUTPUT ──────────────────────────────────────────────────────────────
|
|
opsec_green() { echo -e "\033[38;5;49m[+]\033[0m \033[38;5;49m$*\033[0m"; }
|
|
opsec_red() { echo -e "\033[38;5;196m[-]\033[0m \033[38;5;196m$*\033[0m"; }
|
|
opsec_yellow() { echo -e "\033[38;5;214m[*]\033[0m \033[38;5;214m$*\033[0m"; }
|
|
opsec_info() { echo -e "\033[38;5;39m[~]\033[0m \033[38;5;75m$*\033[0m"; }
|
|
opsec_cyan() { echo -e "\033[38;5;51m[>]\033[0m \033[38;5;51m$*\033[0m"; }
|
|
opsec_mag() { echo -e "\033[38;5;201m[*]\033[0m \033[38;5;201m$*\033[0m"; }
|
|
opsec_dim() { echo -e "\033[38;5;244m $*\033[0m"; }
|
|
opsec_hdr() { echo -e "\033[38;5;51m━━━ \033[38;5;201m$*\033[38;5;51m ━━━\033[0m"; }
|
|
|
|
# ─── CONFIG MANAGEMENT ─────────────────────────────────────────────────────────
|
|
|
|
opsec_load_config() {
|
|
if [ -f "$OPSEC_CONF" ]; then
|
|
# shellcheck disable=SC1090
|
|
. "$OPSEC_CONF"
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
opsec_save_config() {
|
|
# Re-serialize all known keys back to config file
|
|
# Preserves comments and structure
|
|
local tmp
|
|
tmp=$(mktemp)
|
|
cat > "$tmp" << 'HEADER'
|
|
# /etc/opsec/opsec.conf — Central OPSEC Configuration
|
|
# Shell-sourceable KEY="value" format. All scripts source this file.
|
|
# Edit via: sudo opsec-config.sh (interactive TUI)
|
|
|
|
HEADER
|
|
|
|
cat >> "$tmp" << EOF
|
|
# ─── ACTIVE PROFILE ────────────────────────────────────────────────────────────
|
|
PROFILE_NAME="${PROFILE_NAME:-default}"
|
|
|
|
# ─── TOR SETTINGS ──────────────────────────────────────────────────────────────
|
|
TOR_CIRCUIT_ROTATION="${TOR_CIRCUIT_ROTATION:-30}"
|
|
TOR_BLACKLIST="${TOR_BLACKLIST:-}"
|
|
TOR_STRICT_NODES="${TOR_STRICT_NODES:-1}"
|
|
TOR_ISOLATION="${TOR_ISOLATION:-1}"
|
|
TOR_PADDING="${TOR_PADDING:-1}"
|
|
TOR_SOCKS_PORT="${TOR_SOCKS_PORT:-9050}"
|
|
TOR_DNS_PORT="${TOR_DNS_PORT:-5353}"
|
|
TOR_TRANS_PORT="${TOR_TRANS_PORT:-9040}"
|
|
TOR_NUM_GUARDS="${TOR_NUM_GUARDS:-3}"
|
|
TOR_SAFE_LOGGING="${TOR_SAFE_LOGGING:-1}"
|
|
|
|
# ─── DNS SETTINGS ──────────────────────────────────────────────────────────────
|
|
DNS_MODE="${DNS_MODE:-tor}"
|
|
DNS_CUSTOM_SERVERS="${DNS_CUSTOM_SERVERS:-}"
|
|
|
|
# ─── KILL SWITCH ───────────────────────────────────────────────────────────────
|
|
KILLSWITCH_ALLOW_DHCP="${KILLSWITCH_ALLOW_DHCP:-1}"
|
|
KILLSWITCH_ALLOW_OPENVPN="${KILLSWITCH_ALLOW_OPENVPN:-1}"
|
|
KILLSWITCH_ALLOW_WIREGUARD="${KILLSWITCH_ALLOW_WIREGUARD:-1}"
|
|
KILLSWITCH_EXTRA_PORTS="${KILLSWITCH_EXTRA_PORTS:-}"
|
|
|
|
# ─── MAC ADDRESS ───────────────────────────────────────────────────────────────
|
|
MAC_INTERFACES="${MAC_INTERFACES:-auto}"
|
|
MAC_VENDOR_SPOOF="${MAC_VENDOR_SPOOF:-}"
|
|
|
|
# ─── HOSTNAME ──────────────────────────────────────────────────────────────────
|
|
HOSTNAME_PATTERN="${HOSTNAME_PATTERN:-desktop}"
|
|
HOSTNAME_CUSTOM_PREFIX="${HOSTNAME_CUSTOM_PREFIX:-}"
|
|
|
|
# ─── SYSTEM HARDENING ──────────────────────────────────────────────────────────
|
|
HARDEN_IPV6="${HARDEN_IPV6:-1}"
|
|
HARDEN_SWAP="${HARDEN_SWAP:-1}"
|
|
HARDEN_CORE_DUMPS="${HARDEN_CORE_DUMPS:-1}"
|
|
HARDEN_CLIPBOARD_CLEAR="${HARDEN_CLIPBOARD_CLEAR:-0}"
|
|
HARDEN_SCREEN_LOCK="${HARDEN_SCREEN_LOCK:-1}"
|
|
HARDEN_SCREEN_LOCK_TIMEOUT="${HARDEN_SCREEN_LOCK_TIMEOUT:-300}"
|
|
HARDEN_TIMEZONE_SPOOF="${HARDEN_TIMEZONE_SPOOF:-0}"
|
|
HARDEN_TIMEZONE_VALUE="${HARDEN_TIMEZONE_VALUE:-UTC}"
|
|
HARDEN_LOCALE_SPOOF="${HARDEN_LOCALE_SPOOF:-0}"
|
|
HARDEN_LOCALE_VALUE="${HARDEN_LOCALE_VALUE:-en_US.UTF-8}"
|
|
|
|
# ─── LEAK PREVENTION ──────────────────────────────────────────────────────────
|
|
LEAK_WEBRTC_BLOCK="${LEAK_WEBRTC_BLOCK:-1}"
|
|
LEAK_USB_BLOCK="${LEAK_USB_BLOCK:-0}"
|
|
|
|
# ─── MONITORING ────────────────────────────────────────────────────────────────
|
|
MONITOR_PROCESSES="${MONITOR_PROCESSES:-0}"
|
|
MONITOR_LOG_ROTATION="${MONITOR_LOG_ROTATION:-1}"
|
|
LOG_ROTATION_HOURS="${LOG_ROTATION_HOURS:-4}"
|
|
|
|
# ─── TRAFFIC SHAPING ──────────────────────────────────────────────────────────
|
|
TRAFFIC_JITTER_ENABLED="${TRAFFIC_JITTER_ENABLED:-0}"
|
|
TRAFFIC_JITTER_MS="${TRAFFIC_JITTER_MS:-50}"
|
|
|
|
# ─── LEVEL TYPE ───────────────────────────────────────────────────────────────
|
|
LEVEL_TYPE="${LEVEL_TYPE:-standard}"
|
|
|
|
# ─── BASE STATE ───────────────────────────────────────────────────────────────
|
|
BASE_DNS="${BASE_DNS:-quad9}"
|
|
BASE_MAC_RANDOMIZE="${BASE_MAC_RANDOMIZE:-1}"
|
|
BASE_IPV6_DISABLE="${BASE_IPV6_DISABLE:-1}"
|
|
|
|
# ─── TOR BRIDGES ──────────────────────────────────────────────────────────────
|
|
TOR_BRIDGE_MODE="${TOR_BRIDGE_MODE:-off}"
|
|
TOR_BRIDGE_RELAY="${TOR_BRIDGE_RELAY:-}"
|
|
|
|
# ─── SECURE DELETION ──────────────────────────────────────────────────────────
|
|
WIPE_METHOD="${WIPE_METHOD:-auto}"
|
|
|
|
# ─── DEPLOYMENT LEVEL ─────────────────────────────────────────────────────────
|
|
DEPLOYMENT_LEVEL="${DEPLOYMENT_LEVEL:-bare-metal-standard}"
|
|
|
|
# ─── TERMINAL BANNER ──────────────────────────────────────────────────────────
|
|
OPSEC_BANNER="${OPSEC_BANNER:-compact}"
|
|
|
|
# ─── WIDGET THEME ────────────────────────────────────────────────────────────
|
|
WIDGET_THEME="${WIDGET_THEME:-default}"
|
|
EOF
|
|
mv "$tmp" "$OPSEC_CONF"
|
|
chmod 600 "$OPSEC_CONF"
|
|
}
|
|
|
|
opsec_set_value() {
|
|
local key="$1" val="$2"
|
|
if [ -z "$key" ]; then return 1; fi
|
|
# Validate key: must be a valid shell variable name (letters, digits, underscore, starts with letter/underscore)
|
|
if ! echo "$key" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
|
|
echo "[!] opsec_set_value: invalid key name '${key}'" >&2
|
|
return 1
|
|
fi
|
|
# Sanitize value: strip characters that could break shell quoting
|
|
val=$(printf '%s' "$val" | tr -d '`$\\\"'"'" | tr -cd '[:print:]')
|
|
opsec_load_config
|
|
eval "${key}=\"${val}\""
|
|
opsec_save_config
|
|
}
|
|
|
|
opsec_get_value() {
|
|
local key="$1"
|
|
# Validate key: must be a valid shell variable name
|
|
if ! echo "$key" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
|
|
echo "[!] opsec_get_value: invalid key name '${key}'" >&2
|
|
return 1
|
|
fi
|
|
opsec_load_config
|
|
eval "echo \"\${${key}:-}\""
|
|
}
|
|
|
|
# ─── TORRC GENERATION ──────────────────────────────────────────────────────────
|
|
|
|
opsec_generate_torrc() {
|
|
local _dbg="/run/opsec/debug.log"
|
|
echo "[$(date -Is)] [lib] opsec_generate_torrc called" >> "$_dbg" 2>/dev/null || true
|
|
|
|
opsec_load_config || return 1
|
|
|
|
local torrc="/etc/tor/torrc"
|
|
local socks_port="${TOR_SOCKS_PORT:-9050}"
|
|
local trans_port="${TOR_TRANS_PORT:-9040}"
|
|
local dns_port="${TOR_DNS_PORT:-5353}"
|
|
local rotation="${TOR_CIRCUIT_ROTATION:-30}"
|
|
local blacklist="${TOR_BLACKLIST:-}"
|
|
local strict="${TOR_STRICT_NODES:-1}"
|
|
local isolation="${TOR_ISOLATION:-1}"
|
|
local padding="${TOR_PADDING:-1}"
|
|
local guards="${TOR_NUM_GUARDS:-3}"
|
|
local safe_log="${TOR_SAFE_LOGGING:-1}"
|
|
echo "[$(date -Is)] [lib] socks=${socks_port} trans=${trans_port} dns=${dns_port} blacklist=${blacklist}" >> "$_dbg" 2>/dev/null || true
|
|
|
|
# Build SocksPort line with isolation flags
|
|
local socks_line="SocksPort ${socks_port}"
|
|
if [ "$isolation" = "1" ]; then
|
|
socks_line="${socks_line} IsolateDestAddr IsolateDestPort"
|
|
fi
|
|
|
|
# Build ExcludeExitNodes from blacklist
|
|
local exclude_line=""
|
|
if [ -n "$blacklist" ]; then
|
|
local formatted
|
|
formatted=$(echo "$blacklist" | sed 's/\([a-z][a-z]\)/{\1}/g; s/,/,/g')
|
|
exclude_line="ExcludeExitNodes ${formatted}"
|
|
fi
|
|
|
|
local bridge_mode="${TOR_BRIDGE_MODE:-off}"
|
|
local bridge_relay="${TOR_BRIDGE_RELAY:-}"
|
|
|
|
cat > "$torrc" << EOF
|
|
# Autogenerated — do not edit manually
|
|
# Regenerate via: opsec-config.sh --apply
|
|
|
|
# ─── SOCKS, TRANSPARENT PROXY & DNS ─────────────────────────────────────────
|
|
${socks_line}
|
|
TransPort ${trans_port}
|
|
DNSPort ${dns_port}
|
|
|
|
# ─── EXIT NODE EXCLUSION ────────────────────────────────────────────────────
|
|
${exclude_line}
|
|
StrictNodes ${strict}
|
|
|
|
# ─── CIRCUIT ROTATION ───────────────────────────────────────────────────────
|
|
MaxCircuitDirtiness ${rotation}
|
|
|
|
# ─── TRAFFIC PADDING ────────────────────────────────────────────────────────
|
|
ConnectionPadding ${padding}
|
|
|
|
# ─── SAFE LOGGING ────────────────────────────────────────────────────────────
|
|
SafeLogging ${safe_log}
|
|
Log notice file /run/tor/notices.log
|
|
|
|
# ─── ENTRY GUARDS ───────────────────────────────────────────────────────────
|
|
NumEntryGuards ${guards}
|
|
UseEntryGuards 1
|
|
|
|
EOF
|
|
|
|
# ─── PLUGGABLE TRANSPORTS (bridges) ──────────────────────────────────────
|
|
if [ "$bridge_mode" != "off" ] && [ "$bridge_mode" != "" ]; then
|
|
cat >> "$torrc" << 'BRIDGE_HEADER'
|
|
|
|
# ─── BRIDGE CONFIGURATION ────────────────────────────────────────────────────
|
|
UseBridges 1
|
|
BRIDGE_HEADER
|
|
|
|
case "$bridge_mode" in
|
|
obfs4)
|
|
echo "ClientTransportPlugin obfs4 exec /usr/bin/obfs4proxy" >> "$torrc"
|
|
;;
|
|
meek-azure)
|
|
echo "ClientTransportPlugin meek_lite exec /usr/bin/obfs4proxy" >> "$torrc"
|
|
;;
|
|
snowflake)
|
|
# snowflake-client location varies by distro
|
|
local sf_bin
|
|
sf_bin=$(command -v snowflake-client 2>/dev/null || echo "/usr/bin/snowflake-client")
|
|
echo "ClientTransportPlugin snowflake exec ${sf_bin}" >> "$torrc"
|
|
;;
|
|
esac
|
|
|
|
# Add user-specified bridge relay if provided
|
|
if [ -n "$bridge_relay" ]; then
|
|
echo "Bridge ${bridge_relay}" >> "$torrc"
|
|
else
|
|
# Default bridges for each transport type
|
|
case "$bridge_mode" in
|
|
meek-azure)
|
|
echo "Bridge meek_lite 192.0.2.18:80 BE776A53492E1E044A26F17306E1BC46A55A1625 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com" >> "$torrc"
|
|
;;
|
|
snowflake)
|
|
echo "Bridge snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://snowflake-broker.torproject.net.global.prod.fastly.net/ front=foursquare.com ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn" >> "$torrc"
|
|
;;
|
|
esac
|
|
fi
|
|
fi
|
|
|
|
chmod 644 "$torrc"
|
|
echo "[$(date -Is)] [lib] torrc written ($(wc -l < "$torrc") lines)" >> "$_dbg" 2>/dev/null || true
|
|
echo "[$(date -Is)] [lib] torrc contents:" >> "$_dbg" 2>/dev/null || true
|
|
cat "$torrc" >> "$_dbg" 2>/dev/null || true
|
|
echo "[$(date -Is)] [lib] --- end torrc ---" >> "$_dbg" 2>/dev/null || true
|
|
}
|
|
|
|
# ─── RESOLV.CONF GENERATION ───────────────────────────────────────────────────
|
|
|
|
opsec_generate_resolv() {
|
|
local _dbg="/run/opsec/debug.log"
|
|
echo "[$(date -Is)] [lib] opsec_generate_resolv called" >> "$_dbg" 2>/dev/null || true
|
|
|
|
opsec_load_config || return 1
|
|
|
|
local mode="${DNS_MODE:-tor}"
|
|
local resolv="/etc/resolv.conf"
|
|
echo "[$(date -Is)] [lib] DNS_MODE=${mode}" >> "$_dbg" 2>/dev/null || true
|
|
|
|
# Unlock if immutable
|
|
chattr -i "$resolv" 2>/dev/null || true
|
|
|
|
case "$mode" in
|
|
tor)
|
|
echo "nameserver 127.0.0.1" > "$resolv"
|
|
;;
|
|
quad9)
|
|
cat > "$resolv" << 'EOF'
|
|
nameserver 9.9.9.9
|
|
nameserver 149.112.112.112
|
|
EOF
|
|
;;
|
|
cloudflare)
|
|
cat > "$resolv" << 'EOF'
|
|
nameserver 1.1.1.1
|
|
nameserver 1.0.0.1
|
|
EOF
|
|
;;
|
|
doh)
|
|
# DNS-over-HTTPS via dnscrypt-proxy
|
|
# Ensure dnscrypt-proxy is running
|
|
if command -v dnscrypt-proxy >/dev/null 2>&1; then
|
|
# Deploy config if not present
|
|
if [ ! -f /etc/dnscrypt-proxy/dnscrypt-proxy.toml ] && [ -f /etc/opsec/dnscrypt-proxy.toml ]; then
|
|
mkdir -p /etc/dnscrypt-proxy
|
|
cp /etc/opsec/dnscrypt-proxy.toml /etc/dnscrypt-proxy/dnscrypt-proxy.toml
|
|
fi
|
|
mkdir -p /var/log/dnscrypt-proxy /var/cache/dnscrypt-proxy
|
|
# Stop systemd-resolved if it conflicts on :53
|
|
systemctl stop systemd-resolved 2>/dev/null || true
|
|
systemctl start dnscrypt-proxy 2>/dev/null || dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml &
|
|
fi
|
|
cat > "$resolv" << 'EOF'
|
|
nameserver 127.0.0.53
|
|
EOF
|
|
;;
|
|
dot)
|
|
# DNS-over-TLS via systemd-resolved
|
|
cat > "$resolv" << 'EOF'
|
|
nameserver 127.0.0.53
|
|
options edns0 trust-ad
|
|
EOF
|
|
;;
|
|
custom)
|
|
if [ -n "$DNS_CUSTOM_SERVERS" ]; then
|
|
: > "$resolv"
|
|
local IFS=','
|
|
for server in $DNS_CUSTOM_SERVERS; do
|
|
echo "nameserver ${server}" >> "$resolv"
|
|
done
|
|
else
|
|
echo "nameserver 9.9.9.9" > "$resolv"
|
|
fi
|
|
;;
|
|
*)
|
|
echo "nameserver 9.9.9.9" > "$resolv"
|
|
;;
|
|
esac
|
|
|
|
# Lock if in advanced mode
|
|
if opsec_is_advanced; then
|
|
chattr +i "$resolv"
|
|
echo "[$(date -Is)] [lib] resolv.conf locked (chattr +i)" >> "$_dbg" 2>/dev/null || true
|
|
fi
|
|
echo "[$(date -Is)] [lib] resolv.conf contents: $(cat "$resolv" 2>/dev/null | tr '\n' ' ')" >> "$_dbg" 2>/dev/null || true
|
|
}
|
|
|
|
# ─── STATE CHECKS ─────────────────────────────────────────────────────────────
|
|
|
|
opsec_is_advanced() {
|
|
[ -f "$OPSEC_STATE_FILE" ]
|
|
}
|
|
|
|
opsec_is_boot_enabled() {
|
|
[ -f "$OPSEC_BOOT_MARKER" ]
|
|
}
|
|
|
|
# ─── PROFILE MANAGEMENT ───────────────────────────────────────────────────────
|
|
|
|
opsec_profile_save() {
|
|
local name="$1"
|
|
if [ -z "$name" ]; then return 1; fi
|
|
mkdir -p "$OPSEC_PROFILES_DIR"
|
|
cp "$OPSEC_CONF" "${OPSEC_PROFILES_DIR}/${name}.conf"
|
|
# Tag profile name inside the saved copy
|
|
sed -i "s/^PROFILE_NAME=.*/PROFILE_NAME=\"${name}\"/" "${OPSEC_PROFILES_DIR}/${name}.conf"
|
|
}
|
|
|
|
opsec_profile_load() {
|
|
local name="$1"
|
|
local profile="${OPSEC_PROFILES_DIR}/${name}.conf"
|
|
if [ ! -f "$profile" ]; then return 1; fi
|
|
cp "$profile" "$OPSEC_CONF"
|
|
# Update active profile name
|
|
sed -i "s/^PROFILE_NAME=.*/PROFILE_NAME=\"${name}\"/" "$OPSEC_CONF"
|
|
}
|
|
|
|
opsec_profile_list() {
|
|
if [ -d "$OPSEC_PROFILES_DIR" ]; then
|
|
find "$OPSEC_PROFILES_DIR" -name '*.conf' -printf '%f\n' | sed 's/\.conf$//'
|
|
fi
|
|
}
|
|
|
|
opsec_profile_delete() {
|
|
local name="$1"
|
|
rm -f "${OPSEC_PROFILES_DIR}/${name}.conf"
|
|
}
|
|
|
|
opsec_profile_export() {
|
|
local name="$1" dest="$2"
|
|
local profile="${OPSEC_PROFILES_DIR}/${name}.conf"
|
|
if [ ! -f "$profile" ]; then return 1; fi
|
|
cp "$profile" "$dest"
|
|
}
|
|
|
|
opsec_profile_import() {
|
|
local src="$1" name="$2"
|
|
if [ ! -f "$src" ]; then return 1; fi
|
|
mkdir -p "$OPSEC_PROFILES_DIR"
|
|
cp "$src" "${OPSEC_PROFILES_DIR}/${name}.conf"
|
|
}
|
|
|
|
# ─── COUNTRY CODE HELPERS ─────────────────────────────────────────────────────
|
|
|
|
opsec_load_country_presets() {
|
|
if [ -f "$OPSEC_COUNTRY_CODES" ]; then
|
|
# shellcheck disable=SC1090
|
|
. "$OPSEC_COUNTRY_CODES"
|
|
fi
|
|
}
|
|
|
|
opsec_get_preset() {
|
|
local preset="$1"
|
|
opsec_load_country_presets
|
|
case "$preset" in
|
|
5eyes|fiveeyes) echo "$FIVE_EYES" ;;
|
|
9eyes|nineeyes) echo "$NINE_EYES" ;;
|
|
14eyes|fourteeneyes) echo "$FOURTEEN_EYES" ;;
|
|
surveillance) echo "$SURVEILLANCE_STATES" ;;
|
|
max) echo "$MAX_EXCLUSION" ;;
|
|
*) echo "" ;;
|
|
esac
|
|
}
|
|
|
|
# ─── DEPLOYMENT LEVEL MANAGEMENT ─────────────────────────────────────────────
|
|
|
|
OPSEC_LEVELS_DIR="/etc/opsec/levels"
|
|
|
|
opsec_level_list() {
|
|
if [ -d "$OPSEC_LEVELS_DIR" ]; then
|
|
find "$OPSEC_LEVELS_DIR" -name '*.conf' -printf '%f\n' | sed 's/\.conf$//' | sort
|
|
fi
|
|
}
|
|
|
|
opsec_level_apply() {
|
|
local level="$1"
|
|
local level_file="${OPSEC_LEVELS_DIR}/${level}.conf"
|
|
if [ ! -f "$level_file" ]; then
|
|
opsec_red "Level '${level}' not found in ${OPSEC_LEVELS_DIR}"
|
|
return 1
|
|
fi
|
|
|
|
# Preserve current PROFILE_NAME before overwriting
|
|
opsec_load_config 2>/dev/null || true
|
|
local saved_profile="${PROFILE_NAME:-default}"
|
|
|
|
# Copy level preset over active config
|
|
cp "$level_file" "$OPSEC_CONF"
|
|
chmod 600 "$OPSEC_CONF"
|
|
|
|
# Restore profile name and ensure deployment level is tagged
|
|
opsec_load_config
|
|
PROFILE_NAME="$saved_profile"
|
|
DEPLOYMENT_LEVEL="$level"
|
|
opsec_save_config
|
|
}
|
|
|
|
# ─── SECURE DELETION ─────────────────────────────────────────────────────────
|
|
|
|
opsec_detect_storage_type() {
|
|
# Detect storage type for a given path
|
|
# Returns: hdd | ssd | luks | unknown
|
|
local target_path="${1:-/}"
|
|
local device
|
|
|
|
# Find the block device for the path
|
|
device=$(df -P "$target_path" 2>/dev/null | tail -1 | awk '{print $1}')
|
|
[ -z "$device" ] && echo "unknown" && return
|
|
|
|
# Check for LUKS
|
|
if command -v cryptsetup >/dev/null 2>&1; then
|
|
# Check if device is on a dm-crypt layer
|
|
local dm_name
|
|
dm_name=$(basename "$device" 2>/dev/null)
|
|
if [ -e "/sys/block/${dm_name}/dm/uuid" ] 2>/dev/null; then
|
|
local dm_uuid
|
|
dm_uuid=$(cat "/sys/block/${dm_name}/dm/uuid" 2>/dev/null)
|
|
if echo "$dm_uuid" | grep -qi "CRYPT-LUKS"; then
|
|
echo "luks"
|
|
return
|
|
fi
|
|
fi
|
|
# Also check via dmsetup
|
|
if dmsetup info "$device" 2>/dev/null | grep -qi "CRYPT-LUKS"; then
|
|
echo "luks"
|
|
return
|
|
fi
|
|
fi
|
|
|
|
# Resolve to physical disk (strip partition number, handle /dev/mapper)
|
|
local phys_disk
|
|
phys_disk=$(lsblk -ndo PKNAME "$device" 2>/dev/null | head -1)
|
|
[ -z "$phys_disk" ] && phys_disk=$(echo "$device" | sed 's/[0-9]*$//' | sed 's|^/dev/||')
|
|
|
|
# Check rotational flag (0 = SSD, 1 = HDD)
|
|
local rotational_file="/sys/block/${phys_disk}/queue/rotational"
|
|
if [ -f "$rotational_file" ]; then
|
|
local rotational
|
|
rotational=$(cat "$rotational_file" 2>/dev/null)
|
|
if [ "$rotational" = "0" ]; then
|
|
echo "ssd"
|
|
else
|
|
echo "hdd"
|
|
fi
|
|
return
|
|
fi
|
|
|
|
echo "unknown"
|
|
}
|
|
|
|
opsec_secure_delete() {
|
|
# SSD-aware secure file deletion
|
|
# Usage: opsec_secure_delete <file_or_dir> [method]
|
|
# method: auto (default) | shred | fstrim | luks
|
|
local target="$1"
|
|
local method="${2:-${WIPE_METHOD:-auto}}"
|
|
|
|
[ -z "$target" ] && return 1
|
|
|
|
if [ "$method" = "auto" ]; then
|
|
method=$(opsec_detect_storage_type "$target")
|
|
fi
|
|
|
|
case "$method" in
|
|
hdd|shred)
|
|
# Traditional shred for spinning disks
|
|
if [ -d "$target" ]; then
|
|
find "$target" -type f -exec shred -fuz -n 1 {} \; 2>/dev/null
|
|
rm -rf "$target" 2>/dev/null
|
|
elif [ -f "$target" ]; then
|
|
shred -fuz -n 1 "$target" 2>/dev/null
|
|
fi
|
|
;;
|
|
ssd|fstrim)
|
|
# For SSDs: overwrite with zeros, delete, then fstrim
|
|
# shred is ineffective on SSDs due to wear leveling
|
|
if [ -d "$target" ]; then
|
|
find "$target" -type f -exec dd if=/dev/zero of={} bs=4k count=1 conv=notrunc 2>/dev/null \;
|
|
find "$target" -type f -delete 2>/dev/null
|
|
rm -rf "$target" 2>/dev/null
|
|
elif [ -f "$target" ]; then
|
|
dd if=/dev/zero of="$target" bs=4k count=1 conv=notrunc 2>/dev/null
|
|
rm -f "$target" 2>/dev/null
|
|
fi
|
|
# Request TRIM/discard on the filesystem
|
|
local mount_point
|
|
mount_point=$(df -P "${target%/*}" 2>/dev/null | tail -1 | awk '{print $6}')
|
|
if [ -n "$mount_point" ]; then
|
|
fstrim "$mount_point" 2>/dev/null || true
|
|
fi
|
|
;;
|
|
luks)
|
|
# For LUKS: zero file + rely on LUKS key destroy for full wipe
|
|
if [ -d "$target" ]; then
|
|
find "$target" -type f -exec dd if=/dev/zero of={} bs=4k count=1 conv=notrunc 2>/dev/null \;
|
|
find "$target" -type f -delete 2>/dev/null
|
|
rm -rf "$target" 2>/dev/null
|
|
elif [ -f "$target" ]; then
|
|
dd if=/dev/zero of="$target" bs=4k count=1 conv=notrunc 2>/dev/null
|
|
rm -f "$target" 2>/dev/null
|
|
fi
|
|
# Note: full LUKS key destroy handled by emergency-wipe
|
|
;;
|
|
*)
|
|
# Fallback: basic shred
|
|
if [ -d "$target" ]; then
|
|
find "$target" -type f -exec shred -fuz -n 1 {} \; 2>/dev/null
|
|
rm -rf "$target" 2>/dev/null
|
|
elif [ -f "$target" ]; then
|
|
shred -fuz -n 1 "$target" 2>/dev/null
|
|
fi
|
|
;;
|
|
esac
|
|
}
|
|
|
|
# ─── WIDGET THEME MANAGEMENT ─────────────────────────────────────────────────
|
|
|
|
OPSEC_THEMES_DIR="/etc/opsec/themes"
|
|
|
|
opsec_theme_list() {
|
|
if [ -d "$OPSEC_THEMES_DIR" ]; then
|
|
find "$OPSEC_THEMES_DIR" -name '*.theme' -printf '%f\n' | sed 's/\.theme$//' | sort
|
|
fi
|
|
}
|
|
|
|
opsec_generate_conky() {
|
|
opsec_load_config || return 1
|
|
|
|
local theme="${WIDGET_THEME:-default}"
|
|
local theme_file="${OPSEC_THEMES_DIR}/${theme}.theme"
|
|
|
|
if [ ! -f "$theme_file" ]; then
|
|
opsec_red "Theme '${theme}' not found at ${theme_file}"
|
|
return 1
|
|
fi
|
|
|
|
# Source theme to get CONKY_COLOR* and CONKY_BG values
|
|
# shellcheck disable=SC1090
|
|
. "$theme_file"
|
|
|
|
local conky_conf_name="conky-opsec-widget.conf"
|
|
|
|
# Find and regenerate conky config for each user with the widget installed
|
|
for home_dir in /home/*; do
|
|
local conky_conf="${home_dir}/.config/conky/${conky_conf_name}"
|
|
[ -f "$conky_conf" ] || continue
|
|
|
|
local owner
|
|
owner=$(stat -c '%U' "$conky_conf" 2>/dev/null) || continue
|
|
|
|
cat > "$conky_conf" << CONKYEOF
|
|
-- OPSEC Status Widget
|
|
-- Colors managed by theme system via opsec-config.sh
|
|
-- Theme: ${theme} (${THEME_LABEL:-Custom})
|
|
|
|
conky.config = {
|
|
-- Window settings
|
|
alignment = 'top_right',
|
|
gap_x = 15,
|
|
gap_y = 60,
|
|
minimum_width = 400,
|
|
minimum_height = 200,
|
|
maximum_width = 420,
|
|
|
|
-- Multi-monitor: run xrandr --listmonitors to find head number
|
|
xinerama_head = 0,
|
|
|
|
-- Window type
|
|
own_window = true,
|
|
own_window_type = 'desktop',
|
|
own_window_transparent = false,
|
|
own_window_argb_visual = true,
|
|
own_window_argb_value = 210,
|
|
own_window_colour = '${CONKY_BG:-0d1117}',
|
|
own_window_hints = 'undecorated,below,sticky,skip_taskbar,skip_pager',
|
|
|
|
-- Drawing
|
|
double_buffer = true,
|
|
draw_shades = true,
|
|
default_shade_color = '000000',
|
|
draw_outline = false,
|
|
draw_borders = true,
|
|
border_inner_margin = 12,
|
|
border_outer_margin = 4,
|
|
border_width = 1,
|
|
border_colour = '1b3a5c',
|
|
stippled_borders = 0,
|
|
|
|
-- Font
|
|
use_xft = true,
|
|
font = 'JetBrains Mono:size=10',
|
|
override_utf8_locale = true,
|
|
|
|
-- Colors — Theme: ${theme}
|
|
default_color = 'b0b0b0',
|
|
color0 = '${CONKY_COLOR0:-df2020}',
|
|
color1 = '${CONKY_COLOR1:-33ff33}',
|
|
color2 = '${CONKY_COLOR2:-3a8fd6}',
|
|
color3 = '${CONKY_COLOR3:-0d1117}',
|
|
color4 = '${CONKY_COLOR4:-1f6feb}',
|
|
color5 = '${CONKY_COLOR5:-58a6ff}',
|
|
color6 = '${CONKY_COLOR6:-79c0ff}',
|
|
color7 = '${CONKY_COLOR7:-c9d1d9}',
|
|
color8 = '${CONKY_COLOR8:-1f6feb}',
|
|
color9 = '${CONKY_COLOR9:-484f58}',
|
|
|
|
-- Update interval
|
|
update_interval = 3,
|
|
total_run_times = 0,
|
|
|
|
-- Misc
|
|
cpu_avg_samples = 2,
|
|
no_buffers = true,
|
|
text_buffer_size = 8192,
|
|
short_units = true,
|
|
};
|
|
|
|
conky.text = [[
|
|
\${execpi 5 ~/.config/conky/conky-opsec-status.sh}
|
|
]];
|
|
CONKYEOF
|
|
|
|
chown "$owner":"$owner" "$conky_conf"
|
|
chmod 644 "$conky_conf"
|
|
done
|
|
|
|
# Restart conky for all users running the opsec widget
|
|
pkill -f 'conky.*opsec' 2>/dev/null || true
|
|
sleep 1
|
|
|
|
for home_dir in /home/*; do
|
|
local conky_conf="${home_dir}/.config/conky/${conky_conf_name}"
|
|
[ -f "$conky_conf" ] || continue
|
|
|
|
local owner
|
|
owner=$(stat -c '%U' "$conky_conf" 2>/dev/null) || continue
|
|
local uid
|
|
uid=$(id -u "$owner" 2>/dev/null) || continue
|
|
|
|
# Relaunch conky as the file owner
|
|
su - "$owner" -c "DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus nohup conky -c '${conky_conf}' >/dev/null 2>&1 &" 2>/dev/null || true
|
|
done
|
|
}
|
|
|
|
# ─── INIT CHECK ────────────────────────────────────────────────────────────────
|
|
# Ensure /etc/opsec exists
|
|
_opsec_init_dirs() {
|
|
[ -d /etc/opsec ] || mkdir -p /etc/opsec
|
|
[ -d "$OPSEC_PROFILES_DIR" ] || mkdir -p "$OPSEC_PROFILES_DIR"
|
|
}
|
|
|
|
# Auto-init on source if running as root
|
|
if [ "$EUID" = "0" ] 2>/dev/null || [ "$(id -u)" = "0" ] 2>/dev/null; then
|
|
_opsec_init_dirs
|
|
fi
|