Installation

Installation

Important

Open a second terminal as root (pkexec bash or su -) before you install. Keep it open until you've verified sudo still works. If Sentinel locks you out, you can fix /etc/pam.d/* from that root shell.

Compatibility

Compositor	State	Notes
cosmic-comp	tested	primary target
Hyprland	should work	wlroots, layer-shell
Sway	should work	wlroots, layer-shell
KWin/Wayland	should work	layer-shell since KDE 5.21
GNOME/Mutter	no	Mutter doesn't implement zwlr-layer-shell-v1 — use --windowed debug mode
X11 only	not supported	layer-shell is a Wayland protocol

Arch Linux (AUR)

yay -S sentinel        # latest tagged release
yay -S sentinel-git    # tracks main branch HEAD

sentinel and sentinel-git conflict with each other — install only one.

To build the PKGBUILD locally without the AUR:

git clone https://github.com/atayozcan/sentinel
cd sentinel/packaging/arch
makepkg -si

Debian / Ubuntu

A .deb is published with each GitHub release.

curl -LO https://github.com/atayozcan/sentinel/releases/latest/download/sentinel_0.5.1-1_amd64.deb
sudo apt install ./sentinel_0.5.1-1_amd64.deb

The package depends on libpam0g, libwayland-client0, libxkbcommon0, libfontconfig1, libfreetype6, libvulkan1, mesa-vulkan-drivers, dbus, policykit-1. apt resolves these automatically.

Fedora / openSUSE / RHEL

A .rpm is published with each release.

# Fedora / RHEL
curl -LO https://github.com/atayozcan/sentinel/releases/latest/download/sentinel-0.5.1-1.x86_64.rpm
sudo dnf install ./sentinel-0.5.1-1.x86_64.rpm

# openSUSE
sudo zypper install ./sentinel-0.5.1-1.x86_64.rpm

NixOS

The repo is a flake. Add it as an input:

{
  inputs.sentinel.url = "github:atayozcan/sentinel";

  outputs = { self, nixpkgs, sentinel, ... }: {
    nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
      modules = [
        sentinel.nixosModules.default
        { services.sentinel.enable = true; }
      ];
    };
  };
}

Or, ad-hoc:

nix run github:atayozcan/sentinel -- --timeout 10 --randomize

Generic Linux (prebuilt tarball)

curl -LO https://github.com/atayozcan/sentinel/releases/latest/download/sentinel-0.5.1-x86_64-linux.tar.gz
tar xf sentinel-0.5.1-x86_64-linux.tar.gz
cd sentinel-0.5.1
sudo ./install.sh

The tarball mirrors the install layout, so you can also stage it under a non-system prefix and copy out individual files.

From source

git clone https://github.com/atayozcan/sentinel
cd sentinel
sudo ./install.sh                  # default install
sudo ./install.sh --enable-sudo    # also wire pam_sentinel into /etc/pam.d/sudo

install.sh is transactional — every change is recorded in /var/lib/sentinel/install.state and any error mid-install rolls back to the pre-install state. See Architecture for the details.

What gets installed

Path	Purpose
/usr/lib/sentinel-helper	layer-shell confirmation dialog binary
/usr/lib/sentinel-polkit-agent	polkit authentication agent
/usr/lib/security/pam_sentinel.so	PAM module (mode 0755, see Polkit Agent)
/etc/security/sentinel.conf	configuration
/etc/pam.d/polkit-1	PAM stack with pam_sentinel.so wired
/etc/xdg/autostart/sentinel-polkit-agent.desktop	starts the agent at compositor login
/etc/systemd/system/polkit-agent-helper@.service.d/sentinel.conf	drop-in disabling ProtectHome on helper-1
/etc/pam.d/sudo	only with --enable-sudo
/usr/share/man/man{1,5,8}/…	man pages
/usr/share/{bash-completion,fish/vendor_completions.d,zsh/site-functions}/…	shell completions

Distribution packages never touch /etc/pam.d/sudo. Silently rewriting it would be the kind of change that locks people out — too risky for a non-interactive install. To enable Sentinel for sudo post-install:

sudo install -Dm644 /usr/share/doc/sentinel/sudo /etc/pam.d/sudo

Caution

Always have a second root shell open (pkexec bash) when wiring Sentinel into sudo for the first time. If anything goes wrong, you can mv /etc/pam.d/sudo.pre-sentinel.bak /etc/pam.d/sudo from that shell.

Activating the polkit agent

After install, log out and log back in to your graphical session. The XDG autostart entry is only processed by the compositor at session start (see Polkit Agent for why this matters).

Then verify:

pgrep -af sentinel-polkit-agent      # should show the running agent
ls -la $XDG_RUNTIME_DIR/sentinel-agent.sock
pkexec true                           # exactly one Sentinel dialog

Verifying the install

# 1. Binaries + configs in place
ls -l /usr/lib/security/pam_sentinel.so \
      /usr/lib/sentinel-helper \
      /usr/lib/sentinel-polkit-agent \
      /etc/security/sentinel.conf \
      /etc/pam.d/polkit-1

# 2. State file (source-build installs only)
cat /var/lib/sentinel/install.state

# 3. Polkit triggers Sentinel
pkexec ls /root

# 4. If --enable-sudo, sudo triggers it too
sudo -k && sudo true

# 5. Helper standalone
/usr/lib/sentinel-helper --timeout 10 --randomize --process-exe /usr/bin/sudo

Man pages

man sentinel.conf      # configuration reference
man pam_sentinel       # PAM module
man sentinel-helper    # confirmation dialog binary
man sentinel-polkit-agent

Uninstall

sudo ./uninstall.sh           # interactive
sudo ./uninstall.sh --yes     # non-interactive (CI/scripted)

Uninstall reads /var/lib/sentinel/install.state and reverses every change — created files are removed, replaced files are restored from their .pre-sentinel.bak backups.