mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-07-04 16:23:04 +02:00
faff8ba349
* Initial plan * fix: format shell scripts with shfmt (convert tabs to 2 spaces) Co-authored-by: kuhyx <147418882+kuhyx@users.noreply.github.com> * feat: enhance shell-check workflow for PR pre-merge validation - Add pull_request_target trigger to check PRs from forks - Add explicit failure message with instructions - Create BRANCH_PROTECTION.md with setup guide - Ensure workflow runs on all PRs targeting main/master Co-authored-by: kuhyx <147418882+kuhyx@users.noreply.github.com> * refactor: improve workflow security and remove redundant exit code - Remove pull_request_target to avoid executing untrusted fork code - Remove redundant exit 1 from failure step - Update documentation to reflect changes - Standard pull_request trigger handles forks securely Co-authored-by: kuhyx <147418882+kuhyx@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: kuhyx <147418882+kuhyx@users.noreply.github.com>
64 lines
2.3 KiB
Bash
Executable File
64 lines
2.3 KiB
Bash
Executable File
#!/system/bin/sh
|
|
# Runs early in boot - set up hosts file and start watchdog
|
|
# MODDIR is set by Magisk and points to this module's directory
|
|
GUARDIAN_DIR="/data/adb/android_guardian"
|
|
# shellcheck disable=SC2034 # Used for documentation; heredoc defines its own
|
|
MODULE_DIR="/data/adb/modules/android_guardian"
|
|
WATCHDOG_SCRIPT="$GUARDIAN_DIR/watchdog.sh"
|
|
|
|
mkdir -p "$GUARDIAN_DIR"
|
|
|
|
# Log that we're starting
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] post-fs-data: Guardian module loading" >> "$GUARDIAN_DIR/guardian.log"
|
|
|
|
# Create persistent watchdog script that runs independently of module state
|
|
cat > "$WATCHDOG_SCRIPT" << 'WATCHDOG'
|
|
#!/system/bin/sh
|
|
# Secondary watchdog - runs independently of module state
|
|
# Even if module is "disabled" in Magisk UI, this keeps running and undoes it
|
|
GUARDIAN_DIR="/data/adb/android_guardian"
|
|
MODULE_DIR="/data/adb/modules/android_guardian"
|
|
LOG_FILE="$GUARDIAN_DIR/watchdog.log"
|
|
|
|
log() {
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >>"$LOG_FILE"
|
|
}
|
|
|
|
log "=== Watchdog starting ==="
|
|
|
|
while true; do
|
|
# Protect module from Magisk UI disable/remove
|
|
if [ -f "$MODULE_DIR/disable" ]; then
|
|
log "ALERT: Module disable detected via Magisk UI - removing disable flag"
|
|
rm -f "$MODULE_DIR/disable"
|
|
fi
|
|
|
|
if [ -f "$MODULE_DIR/remove" ]; then
|
|
log "ALERT: Module removal detected via Magisk UI - removing remove flag"
|
|
rm -f "$MODULE_DIR/remove"
|
|
fi
|
|
|
|
# Also protect the hosts file directly
|
|
CONTROL_FILE="$GUARDIAN_DIR/control"
|
|
if [ "$(cat "$CONTROL_FILE" 2>/dev/null)" = "ENABLED" ]; then
|
|
if [ -f "$GUARDIAN_DIR/hosts.backup" ] && [ -f "$MODULE_DIR/system/etc/hosts" ]; then
|
|
current_hash=$(md5sum "$MODULE_DIR/system/etc/hosts" 2>/dev/null | cut -d' ' -f1)
|
|
backup_hash=$(md5sum "$GUARDIAN_DIR/hosts.backup" 2>/dev/null | cut -d' ' -f1)
|
|
|
|
if [ "$current_hash" != "$backup_hash" ]; then
|
|
log "ALERT: Hosts tampering detected - restoring"
|
|
cp "$GUARDIAN_DIR/hosts.backup" "$MODULE_DIR/system/etc/hosts"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
sleep 3
|
|
done
|
|
WATCHDOG
|
|
|
|
chmod 755 "$WATCHDOG_SCRIPT"
|
|
|
|
# Start watchdog as a separate background process
|
|
nohup sh "$WATCHDOG_SCRIPT" > /dev/null 2>&1 &
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] post-fs-data: Watchdog started" >> "$GUARDIAN_DIR/guardian.log"
|