Few new features, small refactor, partially tested. #33
Conversation
Keeping it a separate commit.
Read config from local directory, and only if it doesn't exist from /etc. Don't do autoinstall.
+ Open up possibility to scan PCI bus as well.
This adds requirement for argparse, but also opens up possibility of usable parameters. Don't know if I like it.
After killing wait for 60 seconds to omit a kill-loop, if kill ineffective or deliberately slowed-down.
+ keep log file path in configuration file
|
Will look into it. Thanks! |
+ simulation mode with --simulate, for testing code/options. + sleeps not required for avoiding a loop + Reduce log size (lsusb as option)
+ Don't require root with external kill script or simulate mode. + Small correction of messages.
| f.write('\n') | ||
|
|
||
| # Log the message that needed to be logged: | ||
| f.write(line + '\n') |
There was a problem hiding this comment.
why not simply f.write('\n{0}\n'.format(line))
|
I like the use of config parser. It's much more elegant that a bunch of janky string operations. |
|
+1 for the config parser ;)
|
|
Maybe you can add an additional function (for raspberry) that formats the boot device so no forensics can find the 'sensitive' information? (Or mail it??) |
For Luks (cryptsetup): Adding a line to remove keys like |
|
@LinkseRat - that's why I added external kill script in my PR. It's generally advised to overwrite luks header with random bytes to make the drive look completely random + have a luksHeaderBackup stored somewhere safe. I'd use dd for this task, first determine size of the header by backing it up. It's certainly faster than remove/change key. @Brobin - yeah, of course it would be better. One of many places I think even. ;) |
|
Thanks, I added most of these features now. Could you take a look at this issue #51 ? |
|
Thanks. Glad to be of help. Hope it can inspire you even more. You can still add support for different buses (and firewire is particularly known for DMA access to memory). I was also going to add a filter - to allow only specified class of usb devices when the computer is `unlocked'. For example disallow new untrusted HID devices always (mouse wigglers), but allow for new unknown previously pendrives. |
My "take" on this project. I did similar stuff with bash scripts up to date, which wasn't pretty.
I like the ability to be able to connect USB freely when my screen is not locked. I'll further extend it to keep a list of currently connected devices and update it (instead of start devices).
Made better parsed config file and this allowed me to define 4 commands more. Feel free to hate it.