Repository navigation
Security
- Daemon now runs as a dedicated immurok system user in a sandboxed systemd unit. No more $HOME paths; PAM socket moved to /run/immurok/pam.sock.
- Per-command authorization tiers replace the old same-uid check. AUTH only from root/polkitd, management commands require an active local session, rejections return DENY:NOT_AUTHORIZED.
- Owner uid is persisted and checked on every AUTH, so another account's sudo can't be approved by your touch.
- PAM helper installs to /usr/local/bin instead of a user-writable directory.
New
- immurok-session-agent: user-session process for dialogs, notifications and ~/.ssh/config. Holds no keys.
- CLI/TUI read key cache and logs over the socket (KEY:CACHE, SUBSCRIBE:LOG).
- settings and the TUI show whether the daemon is isolated.
- Packaging: system unit, tmpfiles.d, BlueZ D-Bus policy, polkit rule, install/migrate/purge scripts.
Fixed
- Factory-reset device no longer fails silently while the UI says "Paired: Yes". NOT_PAIRED from the device is now honored with a notification and status flag.
- pair no longer refuses with "Already paired" when the device denies the pairing.
- Daemon waits for the BLE helper before sending commands; a session that never exchanged a byte could report itself verified.
- Socket bind failure exits non-zero so systemd restarts the daemon.
- Screen-lock detection rewritten on logind LockedHint; touch-to-unlock works under the system daemon.
- PAM connect() capped at 2 s.
- TUI: Hosts panel marks this machine, explicit slot selection for unpair, enroll can pick auth or switch fingerprint, no black screen at startup.
Verified on Arch, Fedora 44 (SELinux Enforcing), Ubuntu 24.04.