vasilito/RedBear-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: build system hardening — collision detection, validation gates, init path enforcement

Browse Source 
5-phase hardening to prevent silent file-layer collisions (the D-Bus
regression class):

Phase 1: lint-config-paths.sh + make lint-config in depends.mk
Phase 2: CollisionTracker in installer (content-hash comparison)
Phase 3: installs manifests in recipe.toml + validate-file-ownership.sh
Phase 4: validate-init-services.sh + make validate in disk.mk
Phase 5: documentation (AGENTS.md, BUILD-SYSTEM-HARDENING-PLAN.md)

Both redbear-mini and redbear-full build and validate clean.
66 declared install paths in base, zero conflicts.
This commit is contained in:
Vasilito
2026-05-03 22:25:22 +01:00
parent 907d447369
commit 2e764746e7
21 changed files with 1503 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/redbear-device-services.toml
+10 -10
View File
@@ -36,7 +36,7 @@ pattern = "i915/adlp_dmc_ver2_16.bin"
chain = ["i915/adlp_dmc_ver2_14.bin", "i915/adlp_dmc_ver2_12.bin"]
"""
[[files]]
path = "/usr/lib/init.d/12_boot-late.target"
path = "/etc/init.d/12_boot-late.target"
data = """
[unit]
description = "Late boot services target"
@@ -508,7 +508,7 @@ pattern = "i915/adlp_dmc_ver2_16.bin"
chain = ["i915/adlp_dmc_ver2_14.bin", "i915/adlp_dmc_ver2_12.bin"]
"""
[[files]]
path = "/usr/lib/init.d/00_driver-manager.service"
path = "/etc/init.d/00_driver-manager.service"
data = """
[unit]
description = "PCI driver spawner"
@@ -584,7 +584,7 @@ pattern = "i915/adlp_dmc_ver2_16.bin"
chain = ["i915/adlp_dmc_ver2_14.bin", "i915/adlp_dmc_ver2_12.bin"]
"""
[[files]]
path = "/usr/lib/init.d/10_evdevd.service"
path = "/etc/init.d/10_evdevd.service"
data = """
[unit]
description = "Evdev input daemon"
@@ -661,7 +661,7 @@ pattern = "i915/adlp_dmc_ver2_16.bin"
chain = ["i915/adlp_dmc_ver2_14.bin", "i915/adlp_dmc_ver2_12.bin"]
"""
[[files]]
path = "/usr/lib/init.d/15_cpufreqd.service"
path = "/etc/init.d/15_cpufreqd.service"
data = """
[unit]
description = "CPU frequency scaling daemon"
@@ -701,7 +701,7 @@ pattern = "i915/adlp_dmc_ver2_16.bin"
chain = ["i915/adlp_dmc_ver2_14.bin", "i915/adlp_dmc_ver2_12.bin"]
"""
[[files]]
path = "/usr/lib/init.d/15_thermald.service"
path = "/etc/init.d/15_thermald.service"
data = """
[unit]
description = "Thermal management daemon"
@@ -741,7 +741,7 @@ pattern = "i915/adlp_dmc_ver2_16.bin"
chain = ["i915/adlp_dmc_ver2_14.bin", "i915/adlp_dmc_ver2_12.bin"]
"""
[[files]]
path = "/usr/lib/init.d/15_hwrngd.service"
path = "/etc/init.d/15_hwrngd.service"
data = """
[unit]
description = "Hardware RNG entropy daemon"
@@ -781,7 +781,7 @@ pattern = "i915/adlp_dmc_ver2_16.bin"
chain = ["i915/adlp_dmc_ver2_14.bin", "i915/adlp_dmc_ver2_12.bin"]
"""
[[files]]
path = "/usr/lib/init.d/13_driver-params.service"
path = "/etc/init.d/13_driver-params.service"
data = """
[unit]
description = "Driver parameter scheme"
@@ -793,7 +793,7 @@ type = { scheme = "driver-params" }
"""
[[files]]
path = "/usr/lib/init.d/16_redbear-acmd.service"
path = "/etc/init.d/16_redbear-acmd.service"
data = """
[unit]
description = "USB CDC ACM serial daemon"
@@ -805,7 +805,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/16_redbear-ecmd.service"
path = "/etc/init.d/16_redbear-ecmd.service"
data = """
[unit]
description = "USB CDC ECM/NCM ethernet daemon"
@@ -817,7 +817,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/16_redbear-usbaudiod.service"
path = "/etc/init.d/16_redbear-usbaudiod.service"
data = """
[unit]
description = "USB Audio Class daemon"
config/redbear-full.toml
+20 -19
View File
@@ -159,7 +159,7 @@ data = "/usr/share/fonts"
symlink = true
[[files]]
path = "/usr/lib/init.d/05_boot-essential.target"
path = "/etc/init.d/05_boot-essential.target"
data = """
[unit]
description = "Boot essential services target"
@@ -169,7 +169,7 @@ requires_weak = [
"""
[[files]]
path = "/usr/lib/init.d/13_iommu.service"
path = "/etc/init.d/13_iommu.service"
data = """
[unit]
description = "IOMMU DMA remapping daemon"
@@ -184,7 +184,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/12_dbus.service"
path = "/etc/init.d/12_dbus.service"
data = """
[unit]
description = "D-Bus system bus"
@@ -200,7 +200,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/13_redbear-sessiond.service"
path = "/etc/init.d/13_redbear-sessiond.service"
data = """
[unit]
description = "Red Bear session broker (org.freedesktop.login1)"
@@ -214,7 +214,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/13_seatd.service"
path = "/etc/init.d/13_seatd.service"
data = """
[unit]
description = "seatd seat management daemon"
@@ -230,7 +230,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/13_redbear-keymapd.service"
path = "/etc/init.d/13_redbear-keymapd.service"
data = """
[unit]
description = "Runtime keymap daemon"
@@ -244,7 +244,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/13_redbear-ime.service"
path = "/etc/init.d/13_redbear-ime.service"
data = """
[unit]
description = "Input method engine daemon"
@@ -258,7 +258,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/13_redbear-accessibility.service"
path = "/etc/init.d/13_redbear-accessibility.service"
data = """
[unit]
description = "Accessibility input filter daemon (sticky/slow/bounce keys)"
@@ -272,7 +272,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/14_redbear-upower.service"
path = "/etc/init.d/14_redbear-upower.service"
data = """
[unit]
description = "UPower D-Bus service (org.freedesktop.UPower)"
@@ -286,7 +286,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/14_redbear-udisks.service"
path = "/etc/init.d/14_redbear-udisks.service"
data = """
[unit]
description = "UDisks2 D-Bus service (org.freedesktop.UDisks2)"
@@ -300,7 +300,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/14_redbear-polkit.service"
path = "/etc/init.d/14_redbear-polkit.service"
data = """
[unit]
description = "PolicyKit1 D-Bus service (org.freedesktop.PolicyKit1)"
@@ -314,7 +314,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/19_redbear-authd.service"
path = "/etc/init.d/19_redbear-authd.service"
data = """
[unit]
description = "Red Bear authentication daemon"
@@ -329,7 +329,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/20_display.service"
path = "/etc/init.d/20_display.service"
data = """
[unit]
description = "KDE session assembly helper"
@@ -349,7 +349,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/20_greeter.service"
path = "/etc/init.d/20_greeter.service"
data = """
[unit]
description = "Red Bear greeter service"
@@ -369,7 +369,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/29_activate_console.service"
path = "/etc/init.d/29_activate_console.service"
data = """
[unit]
description = "Activate fallback console VT"
@@ -384,7 +384,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/30_console.service"
path = "/etc/init.d/30_console.service"
data = """
[unit]
description = "Console terminals"
@@ -399,7 +399,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/31_debug_console.service"
path = "/etc/init.d/31_debug_console.service"
data = """
[unit]
description = "Debug console on serial port"
@@ -409,12 +409,13 @@ requires_weak = [
[service]
cmd = "getty"
args = ["/scheme/debug", "-J"]
args = ["/scheme/debug/no-preserve", "-J"]
type = "oneshot_async"
respawn = true
"""
[[files]]
path = "/usr/lib/init.d/99_diag_serial.service"
path = "/etc/init.d/99_diag_serial.service"
data = """
[unit]
description = "Serial diagnostic marker"
config/redbear-greeter-services.toml
+7 -7
View File
@@ -3,7 +3,7 @@
# This fragment is intended to be included by the active desktop/graphics target.
[[files]]
path = "/usr/lib/init.d/05_boot-essential.target"
path = "/etc/init.d/05_boot-essential.target"
data = """
[unit]
description = "Boot essential services target"
@@ -30,7 +30,7 @@ redbear-session-launch = {}
redbear-greeter = {}
[[files]]
path = "/usr/lib/init.d/19_redbear-authd.service"
path = "/etc/init.d/19_redbear-authd.service"
data = """
[unit]
description = "Red Bear authentication daemon"
@@ -44,7 +44,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/20_display.service"
path = "/etc/init.d/20_display.service"
data = """
[unit]
description = "Compositor proof (Phase 2: KWin virtual + Qt6 smoke + 60s survival)"
@@ -61,7 +61,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/20_greeter.service"
path = "/etc/init.d/20_greeter.service"
data = """
[unit]
description = "Red Bear greeter service (experimental — Phase 3 user session bring-up)"
@@ -80,7 +80,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/30_console.service"
path = "/etc/init.d/30_console.service"
data = """
[unit]
description = "Console terminals"
@@ -96,7 +96,7 @@ respawn = true
"""
[[files]]
path = "/usr/lib/init.d/29_activate_console.service"
path = "/etc/init.d/29_activate_console.service"
data = """
[unit]
description = "Activate fallback console VT"
@@ -111,7 +111,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/31_debug_console.service"
path = "/etc/init.d/31_debug_console.service"
data = """
[unit]
description = "Debug console"
config/redbear-legacy-base.toml
+1 -1
View File
@@ -16,7 +16,7 @@
zsh = {}
[[files]]
path = "/usr/lib/init.d/00_base.service"
path = "/etc/init.d/00_base.service"
data = """
[unit]
description = "Base environment setup (tmpdir)"
config/redbear-legacy-desktop.toml
+4 -4
View File
@@ -4,17 +4,17 @@
# the active redbear-full config provides its own display/console/greeter services.
[[files]]
path = "/usr/lib/init.d/20_display.service"
path = "/etc/init.d/20_display.service"
data = ""
[[files]]
path = "/usr/lib/init.d/29_activate_console.service"
path = "/etc/init.d/29_activate_console.service"
data = ""
[[files]]
path = "/usr/lib/init.d/30_console.service"
path = "/etc/init.d/30_console.service"
data = ""
[[files]]
path = "/usr/lib/init.d/31_debug_console.service"
path = "/etc/init.d/31_debug_console.service"
data = ""
config/redbear-mini.toml
+15 -11
View File
@@ -296,7 +296,7 @@ type = { scheme = "ucsi" }
"""
[[files]]
path = "/usr/lib/init.d/12_boot-late.target"
path = "/etc/init.d/12_boot-late.target"
data = """
[unit]
description = "Late boot services target"
@@ -306,7 +306,7 @@ requires_weak = [
"""
[[files]]
path = "/usr/lib/init.d/11_udev.service"
path = "/etc/init.d/11_udev.service"
data = """
[unit]
description = "udev compatibility shim"
@@ -317,11 +317,11 @@ requires_weak = [
[service]
cmd = "udev-shim"
type = { scheme = "udev" }
type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/10_evdevd.service"
path = "/etc/init.d/10_evdevd.service"
data = """
[unit]
description = "Evdev input daemon"
@@ -336,7 +336,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/11_wifictl.service"
path = "/etc/init.d/11_wifictl.service"
data = """
[unit]
description = "Wi-Fi control daemon"
@@ -351,7 +351,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/12_dbus.service"
path = "/etc/init.d/12_dbus.service"
data = """
[unit]
description = "D-Bus system bus"
@@ -366,7 +366,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/13_redbear-sessiond.service"
path = "/etc/init.d/13_redbear-sessiond.service"
data = """
[unit]
description = "Red Bear session broker (org.freedesktop.login1)"
@@ -380,7 +380,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/13_iommu.service"
path = "/etc/init.d/13_iommu.service"
data = """
[unit]
description = "IOMMU DMA remapping daemon"
@@ -395,7 +395,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/14_redbear-upower.service"
path = "/etc/init.d/14_redbear-upower.service"
data = """
[unit]
description = "UPower D-Bus service (org.freedesktop.UPower)"
@@ -409,7 +409,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/14_redbear-udisks.service"
path = "/etc/init.d/14_redbear-udisks.service"
data = """
[unit]
description = "UDisks2 D-Bus service (org.freedesktop.UDisks2)"
@@ -423,7 +423,7 @@ type = "oneshot_async"
"""
[[files]]
path = "/usr/lib/init.d/14_redbear-polkit.service"
path = "/etc/init.d/14_redbear-polkit.service"
data = """
[unit]
description = "PolicyKit1 D-Bus service (org.freedesktop.PolicyKit1)"
@@ -465,3 +465,7 @@ path = "/etc/pcid.d/00_text_mode_gpu_mask.toml"
data = """
# redbear-live-mini: no display driver matched; class 0x03 devices are skipped
"""
[[files]]
path = "/etc/environment.d/10-debug.conf"
data = "INIT_LOG_LEVEL=DEBUG"
config/redbear-netctl.toml
+1 -1
View File
@@ -90,7 +90,7 @@ IP=bounded
"""
[[files]]
path = "/usr/lib/init.d/12_netctl.service"
path = "/etc/init.d/12_netctl.service"
data = """
[unit]
description = "Network profile application"