Installation

Installation

Important

Open a second terminal as root (pkexec bash or su -) before you install. Keep it open until you've verified sudo still works. If Sentinel locks you out, you can fix /etc/pam.d/* from that root shell.

Compatibility

Compositor	State	Notes
cosmic-comp	tested	primary target
Hyprland	should work	wlroots, layer-shell
Sway	should work	wlroots, layer-shell
KWin/Wayland	should work	layer-shell since KDE 5.21
GNOME/Mutter	no	Mutter doesn't implement zwlr-layer-shell-v1 — use --windowed debug mode
X11 only	not supported	layer-shell is a Wayland protocol

Arch Linux (AUR)

yay -S sentinel        # latest tagged release
yay -S sentinel-git    # tracks main branch HEAD

sentinel and sentinel-git conflict with each other — install only one.

To build the PKGBUILD locally without the AUR:

git clone https://github.com/atayozcan/sentinel
cd sentinel/packaging/arch
makepkg -si

Debian / Ubuntu

A .deb is published with each GitHub release.

curl -LO https://github.com/atayozcan/sentinel/releases/latest/download/sentinel_0.2.0-1_amd64.deb
sudo apt install ./sentinel_0.2.0-1_amd64.deb

The package depends on libpam0g, libwayland-client0, libxkbcommon0, libfontconfig1, libfreetype6, libvulkan1, mesa-vulkan-drivers. apt will resolve these automatically.

Fedora / openSUSE / RHEL

A .rpm is published with each release.

# Fedora / RHEL
curl -LO https://github.com/atayozcan/sentinel/releases/latest/download/sentinel-0.2.0-1.x86_64.rpm
sudo dnf install ./sentinel-0.2.0-1.x86_64.rpm

# openSUSE
sudo zypper install ./sentinel-0.2.0-1.x86_64.rpm

NixOS

The repo is a flake. Add it as an input:

{
  inputs.sentinel.url = "github:atayozcan/sentinel";

  outputs = { self, nixpkgs, sentinel, ... }: {
    nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
      modules = [
        sentinel.nixosModules.default
        { services.sentinel.enable = true; }
      ];
    };
  };
}

Or, ad-hoc:

nix run github:atayozcan/sentinel -- --timeout 10 --randomize

Generic Linux (prebuilt tarball)

curl -LO https://github.com/atayozcan/sentinel/releases/latest/download/sentinel-0.2.0-x86_64-linux.tar.gz
tar xf sentinel-0.2.0-x86_64-linux.tar.gz
cd sentinel-0.2.0
pkexec ./install.sh

The tarball mirrors the install layout, so you can also stage it under a non-system prefix and copy out individual files.

From source

git clone https://github.com/atayozcan/sentinel
cd sentinel
just install                 # builds, then runs install.sh under pkexec
# or:
pkexec ./install.sh
pkexec ./install.sh --enable-sudo   # also wire into /etc/pam.d/sudo

install.sh is transactional — see Architecture for the details of how install/uninstall work.

Verifying the install

ls -l /usr/lib/security/pam_sentinel.so /usr/lib/sentinel-helper /etc/security/sentinel.conf /etc/pam.d/polkit-1
cat /var/lib/sentinel/install.state    # everything install.sh did

Test the helper directly:

/usr/lib/sentinel-helper --timeout 10 --randomize --process-exe /usr/bin/sudo

Should paint a layer-shell overlay; Allow exits 0, Deny / timeout exit 1.

Test the full PAM path with pamtester against a throwaway service (scripts/dev-test.sh automates this).

Uninstall

pkexec ./uninstall.sh           # interactive
pkexec ./uninstall.sh --yes     # non-interactive (CI/scripted)

Uninstall reads /var/lib/sentinel/install.state and reverses every change — created files are removed, replaced files are restored from their .pre-sentinel.bak backups. If you'd customised polkit-1, sudo, or sentinel.conf before installing, your originals come back exactly as they were.