Security Sentinel 1.4.0

This release comes out of a full-stack security audit of the engine, the
panel and the packaging. It fixes several cases where the plugin reported
"secure" while it was not, moves every privileged action behind the shipped
polkit policy, and replaces polling with an event-driven background monitor.

Added

• Background monitor (sentinel-engine --daemon): reacts to USB
  hot-plug through kernel uevents within about a second instead of the next
  20 s poll, and publishes a cached report to
  $XDG_RUNTIME_DIR/omarchy-security-sentinel/report.json (0600). The panel
  starts it; it stays in the graphical session so polkit allow_active works.
• Real CVE data: the CVE radar matches installed packages against the
  Arch Security Tracker via arch-audit (CVE IDs, severity, fixed version,
  cached for 6 h). A critical advisory with a released fix raises an alert.
• Socket attribution: every listening and connected socket names its
  process and PID. Real IPv6 addresses are shown, and the socket analyzer
  (rogue sshd, nc/socat listeners, plaintext services) now actually runs.
• BadUSB fingerprints: the trust baseline (trusted_usb.json v2) pins
  serial number and interface classes, not just VID:PID, so a device that
  clones a trusted ID but adds a keyboard interface is caught. Old baselines
  are upgraded in place.
• Confirmations: Freeze, Kill and Panic Blackout need a second click,
  and the armed button names its target.
• CI workflow: cargo fmt, clippy -D warnings, tests and an MSRV 1.88
  build on every push.

Fixed

• Privilege escalation goes through a root-side helper mode, so pkexec
  runs /usr/bin/sentinel-engine and the shipped polkit actions and messages
  apply. No more sh -c in privileged paths; every argument is re-validated
  as root.
• Freeze, terminate and thaw signal through a pidfd, so a recycled PID is
  never hit. A process renamed to sshd or Hyprland is no longer immune.
• CLI arguments are dispatched on the first argument only, so a file name
  passed to --clean-files cannot trigger another command.
• Network quarantine is one idempotent nftables transaction covering both
  directions; socket sever only targets connected sockets and checks the
  result.
• Toggles (Ghost MAC, DNS, USB Armor) report failure and the panel rolls
  the switch back, instead of always announcing success.
• The CVE radar reports a warning when checkupdates or arch-audit fails,
  instead of "up to date".
• Auth watch filters in journald, so the 24 h window is really covered.
• The JPEG metadata scrubber keeps colour profiles and refuses malformed
  files instead of overwriting the original with a truncated copy.
• Perl and Ruby reverse-shell signatures could never match; they do now.
• Forensic evidence JSON is built with serde instead of string splicing.
• USB Armor no longer strands trusted devices:
  • a corrupt baseline does not de-authorize every device;
  • hubs are never auto-blocked (that cut off the keyboard behind them);
  • "Trust Devices" re-enables blocked devices, waits for them, then trusts
    the full set;
  • identical units (two hubs, two receivers) both stay trusted;
  • root hub interfaces are read under their real sysfs names;
  • entries recorded with an empty interface set are re-learned;
  • a declined block prompt is remembered until the device is replugged,
    so pkexec is not raised on every scan.
• USB product strings are sanitized and all dynamic panel text is plain
  text.

Changed

• Panel and dashboard follow the Omarchy look: flat rows, square corners,
  theme colours, plain-text verdicts, no duplicate buttons, shorter labels.
  Notifications use short plain sentences.
• The engine is split into one module per subsystem; statuses are typed
  enums. The JSON read by the panel is unchanged.

Security Sentinel v1.1.0

Security Sentinel v1.1.0

Overview

Security Sentinel v1.1.0 introduces native DBus desktop notification delivery, procfs bounded read safeguards, C2 threat intelligence detection, and typography compliance.

What Was Fixed & Added

1. DBus Desktop Notification Delivery

• Fixed environment variable propagation ensuring notification daemons can establish direct DBus session connectivity.
• High-priority security alerts now trigger instant system-level desktop notifications.

2. Procfs Bounded Read Defense (DoS Prevention)

• Enforced strict memory limits on procfs file reads (take(MAX + 1)).
• Protects the daemon against memory exhaustion and infinite stream blocking.

3. C2 Threat Detection & Network Telemetry

• Enhanced Command & Control (C2) threat detection rules monitoring outbound sockets.
• Integrated automated telemetry reporting with low CPU and memory footprint.

4. Typography & Standards

• Enforced default font chain: "JetBrainsMono Nerd Font, JetBrains Mono, monospace".
• Adheres to HANCORE security architecture standards.

Release Assets

• sentinel-engine: Native Rust security and threat monitoring engine for x86_64 Linux.