@sebastienrousseau/dotfiles 0.2.499 → 0.2.501

package/scripts/security/enforce-policies.sh

@@ -0,0 +1,334 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Security Policy Enforcement Script
+# This script enforces security policies across the dotfiles repository
+
+set -euo pipefail
+
+# Script configuration
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly SCRIPT_DIR
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+readonly REPO_ROOT
+readonly POLICIES_DIR="${REPO_ROOT}/.github/security-policies"
+readonly LOG_FILE="${REPO_ROOT}/.security-audit.log"
+
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "${SCRIPT_DIR}/../dot/lib/ui.sh"
+ui_init
+
+# Logging function (also writes to log file)
+log() {
+  local level="$1"
+  shift
+  local message="$*"
+  local timestamp
+  timestamp=$(date -u '+%Y-%m-%d %H:%M:%S UTC')
+  echo "[${timestamp}] [${level}] ${message}" | tee -a "${LOG_FILE}"
+}
+
+# Error handling
+error_exit() {
+  log "ERROR" "$1"
+  exit 1
+}
+
+# Check if required tools are installed
+check_dependencies() {
+  log "INFO" "Checking dependencies..."
+
+  local missing_tools=()
+
+  # Required tools
+  local tools=("opa" "gitleaks" "shellcheck" "grep" "find")
+
+  for tool in "${tools[@]}"; do
+    if ! command -v "$tool" &>/dev/null; then
+      missing_tools+=("$tool")
+    fi
+  done
+
+  if [[ ${#missing_tools[@]} -gt 0 ]]; then
+    error_exit "Missing required tools: ${missing_tools[*]}"
+  fi
+
+  log "INFO" "All dependencies satisfied"
+}
+
+# Scan for hardcoded secrets
+scan_secrets() {
+  log "INFO" "Scanning for hardcoded secrets..."
+
+  local violations=0
+
+  # Run gitleaks
+  if gitleaks detect --source="${REPO_ROOT}" --config="${REPO_ROOT}/config/gitleaks.toml" --no-git >/dev/null 2>&1; then
+    log "INFO" "✅ No secrets detected by gitleaks"
+  else
+    log "WARN" "❌ Potential secrets detected by gitleaks"
+    violations=$((violations + 1))
+  fi
+
+  # Manual pattern checks
+  local secret_patterns=(
+    'password\s*=\s*["\047][^"\047]*["\047]'
+    'token\s*=\s*["\047][^"\047]*["\047]'
+    'secret\s*=\s*["\047][^"\047]*["\047]'
+    'key\s*=\s*["\047][^"\047]*["\047]'
+    'AKIA[0-9A-Z]{16}' # AWS Access Key
+    '[0-9a-f]{32,}'    # Potential hash/token
+  )
+
+  for pattern in "${secret_patterns[@]}"; do
+    if grep -r -E -i "${pattern}" "${REPO_ROOT}" \
+      --exclude-dir=".git" \
+      --exclude="*.log" \
+      --exclude="enforce-policies.sh" \
+      --exclude="environment-template.env" >/dev/null 2>&1; then
+      log "WARN" "❌ Potential hardcoded credential pattern found: ${pattern}"
+      violations=$((violations + 1))
+    fi
+  done
+
+  if [[ $violations -eq 0 ]]; then
+    log "INFO" "✅ No hardcoded secrets detected"
+  fi
+
+  return $violations
+}
+
+# Check file permissions
+check_file_permissions() {
+  log "INFO" "Checking file permissions..."
+
+  local violations=0
+
+  # Check for overly permissive files
+  while IFS= read -r -d '' file; do
+    if [[ -f "$file" ]]; then
+      local perms
+      perms=$(stat -c %a "$file" 2>/dev/null || stat -f %OLp "$file")
+      if [[ $perms -gt 755 ]]; then
+        log "WARN" "❌ Overly permissive file: ${file} (${perms})"
+        violations=$((violations + 1))
+      fi
+    fi
+  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -print0)
+
+  # Check for executable text files
+  local text_extensions=("md" "txt" "json" "yaml" "yml" "toml")
+
+  for ext in "${text_extensions[@]}"; do
+    while IFS= read -r -d '' file; do
+      if [[ -x "$file" ]]; then
+        log "WARN" "❌ Executable text file: ${file}"
+        violations=$((violations + 1))
+      fi
+    done < <(find "${REPO_ROOT}" -name "*.${ext}" -executable -not -path "*/.git/*" -print0)
+  done
+
+  if [[ $violations -eq 0 ]]; then
+    log "INFO" "✅ File permissions are appropriate"
+  fi
+
+  return $violations
+}
+
+# Validate shell scripts
+validate_shell_scripts() {
+  log "INFO" "Validating shell scripts..."
+
+  local violations=0
+
+  while IFS= read -r -d '' script; do
+    if ! shellcheck "$script" >/dev/null 2>&1; then
+      log "WARN" "❌ ShellCheck violations in: ${script}"
+      violations=$((violations + 1))
+    fi
+  done < <(find "${REPO_ROOT}" -name "*.sh" -not -path "*/.git/*" -print0)
+
+  if [[ $violations -eq 0 ]]; then
+    log "INFO" "✅ All shell scripts pass validation"
+  fi
+
+  return $violations
+}
+
+# Check environment variable usage
+check_environment_variables() {
+  log "INFO" "Checking environment variable usage..."
+
+  local violations=0
+
+  # Look for unprotected variable assignments
+  while IFS= read -r -d '' file; do
+    # Skip binary files and specific files
+    if file "$file" | grep -q "text" && [[ ! "$file" =~ \.(log|env)$ ]]; then
+      # Check for variables that should use default patterns
+      if grep -E '^[A-Z_]+=.+$' "$file" >/dev/null 2>&1; then
+        # Check if they use proper defaulting
+        if ! grep -E '\$\{[A-Z_]+:-[^}]*\}' "$file" >/dev/null 2>&1; then
+          local suspicious_vars
+          suspicious_vars=$(grep -E '^[A-Z_]+=.+$' "$file" | head -3)
+          if [[ -n "$suspicious_vars" ]]; then
+            log "WARN" "❌ Potential hardcoded variables in ${file}: ${suspicious_vars}"
+            violations=$((violations + 1))
+          fi
+        fi
+      fi
+    fi
+  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -not -path "*/.github/security-policies/*" -print0)
+
+  if [[ $violations -eq 0 ]]; then
+    log "INFO" "✅ Environment variable usage is appropriate"
+  fi
+
+  return $violations
+}
+
+# Validate OPA policies
+validate_policies() {
+  log "INFO" "Validating OPA policies..."
+
+  if [[ ! -f "${POLICIES_DIR}/security.rego" ]]; then
+    log "WARN" "❌ Security policy file not found"
+    return 1
+  fi
+
+  if opa test "${POLICIES_DIR}" >/dev/null 2>&1; then
+    log "INFO" "✅ OPA policies are valid"
+    return 0
+  else
+    log "WARN" "❌ OPA policy validation failed"
+    return 1
+  fi
+}
+
+# Check for sensitive files
+check_sensitive_files() {
+  log "INFO" "Checking for sensitive files..."
+
+  local violations=0
+  local sensitive_patterns=(
+    "*.key"
+    "*.pem"
+    "*.p12"
+    "*.pfx"
+    "*.jks"
+    "*.keystore"
+    ".env"
+    ".env.*"
+    "credentials.json"
+    "service-account.json"
+    "id_rsa"
+    "id_dsa"
+    "id_ecdsa"
+    "id_ed25519"
+  )
+
+  for pattern in "${sensitive_patterns[@]}"; do
+    while IFS= read -r -d '' file; do
+      # Skip allowed files
+      if [[ ! "$file" =~ (environment-template\.env|\.pub$) ]]; then
+        log "WARN" "❌ Sensitive file detected: ${file}"
+        violations=$((violations + 1))
+      fi
+    done < <(find "${REPO_ROOT}" -name "${pattern}" -not -path "*/.git/*" -print0)
+  done
+
+  if [[ $violations -eq 0 ]]; then
+    log "INFO" "✅ No sensitive files detected"
+  fi
+
+  return $violations
+}
+
+# Generate security report
+generate_report() {
+  local total_violations="$1"
+  local report_file="${REPO_ROOT}/security-report.md"
+
+  log "INFO" "Generating security report..."
+
+  cat >"${report_file}" <<EOF
+# Security Policy Enforcement Report
+
+**Generated:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')
+**Repository:** $(basename "${REPO_ROOT}")
+**Total Violations:** ${total_violations}
+
+## Security Checks Performed
+
+- ✅ Secrets scanning (gitleaks + manual patterns)
+- ✅ File permissions validation
+- ✅ Shell script analysis (shellcheck)
+- ✅ Environment variable usage check
+- ✅ OPA policy validation
+- ✅ Sensitive files detection
+
+## Security Score
+
+$(if [[ $total_violations -eq 0 ]]; then echo "🟢 **PASSED** - No security violations detected"; else echo "🔴 **FAILED** - ${total_violations} violations detected"; fi)
+
+## Recommendations
+
+1. Review any flagged violations in the audit log
+2. Update hardcoded values to use environment variables
+3. Ensure proper file permissions (644 for files, 755 for executables)
+4. Use the provided environment template for configuration
+5. Run this script regularly as part of your development workflow
+
+## Next Steps
+
+- Fix any identified violations
+- Run \`scripts/security/enforce-policies.sh\` again to verify fixes
+- Consider setting up automated policy enforcement in CI/CD
+
+---
+*This report was generated by the automated security policy enforcement system.*
+EOF
+
+  log "INFO" "Security report generated: ${report_file}"
+}
+
+# Main execution
+main() {
+  log "INFO" "Starting security policy enforcement..."
+
+  # Initialize log file
+  echo "# Security Audit Log - $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >"${LOG_FILE}"
+
+  check_dependencies
+
+  local total_violations=0
+
+  # Run all checks
+  scan_secrets || total_violations=$((total_violations + $?))
+  check_file_permissions || total_violations=$((total_violations + $?))
+  validate_shell_scripts || total_violations=$((total_violations + $?))
+  check_environment_variables || total_violations=$((total_violations + $?))
+  validate_policies || total_violations=$((total_violations + 1))
+  check_sensitive_files || total_violations=$((total_violations + $?))
+
+  # Generate report
+  generate_report "$total_violations"
+
+  # Final result
+  if [[ $total_violations -eq 0 ]]; then
+    ui_ok "All security checks passed"
+    log "INFO" "Security policy enforcement completed successfully"
+    exit 0
+  else
+    ui_err "$total_violations violations" "Security policy enforcement failed"
+    ui_warn "Details" "Check ${LOG_FILE}"
+    ui_warn "Report" "Review security-report.md"
+    log "ERROR" "Security policy enforcement failed with ${total_violations} violations"
+    exit 1
+  fi
+}
+
+# Script entry point
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main "$@"
+fi

package/scripts/security/firewall.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Configure system firewall with secure defaults.
+##
+## Enables firewall with deny-by-default policy and minimal exceptions.
+## Requires explicit opt-in via DOTFILES_FIREWALL=1 to prevent accidental
+## lockouts.
+##
+## # Usage
+## DOTFILES_FIREWALL=1 dot firewall
+##
+## # Dependencies
+## - macOS: socketfilterfw (built-in)
+## - Linux: ufw (Uncomplicated Firewall)
+##
+## # Platform Notes
+## ### Platform: macOS
+## - Enables Application Firewall via socketfilterfw
+## - Enables stealth mode (no ICMP responses)
+## - Allows signed applications
+##
+## ### Platform: Linux
+## - Configures UFW with deny incoming / allow outgoing
+## - Allows OpenSSH to prevent lockout
+## - Requires ufw package installed
+##
+## # Security
+## **Requires sudo.** All changes logged to dotfiles.log.
+##
+## # Side Effects
+## - Modifies system firewall rules
+## - May block existing connections
+##
+## # Idempotency
+## Safe to run repeatedly. Applies same rules each time.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "Firewall"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_FIREWALL:-}" != "1" ]; then
+  ui_warn "Firewall" "disabled by default"
+  ui_info "Re-run" "DOTFILES_FIREWALL=1"
+  exit 1
+fi
+
+case "$(dot_platform_id)" in
+  macos)
+    ui_info "Enabling" "macOS firewall"
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp on
+    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
+    ;;
+  linux | wsl)
+    if command -v ufw >/dev/null; then
+      ui_info "Enabling" "UFW"
+      _run_cmd sudo ufw default deny incoming
+      _run_cmd sudo ufw default allow outgoing
+      _run_cmd sudo ufw allow OpenSSH
+      _run_cmd sudo ufw --force enable
+    else
+      ui_err "ufw" "not installed; re-run after install"
+      exit 1
+    fi
+    ;;
+  *)
+    ui_err "Unsupported OS" "firewall setup"
+    exit 1
+    ;;
+esac

package/scripts/security/lock-configs.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# MIT License
+# Copyright (c) 2026
+# See LICENSE file for details.
+
+# Script: lock-configs.sh
+# Description: Toggles immutability flags on critical configuration files.
+# Usage: lock-configs [lock|unlock]
+
+set -euo pipefail
+
+ACTION="${1:-lock}"
+CRITICAL_FILES=(
+  "$HOME/.zshrc"
+  "$HOME/.bashrc"
+  "$HOME/.profile"
+)
+
+# Determine OS command for immutability
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  LOCK_CMD="chflags uchg"
+  UNLOCK_CMD="chflags nouchg"
+  CHECK_CMD="ls -lO"
+else
+  # Linux (requires root usually, but we'll try)
+  if command -v chattr >/dev/null; then
+    LOCK_CMD="sudo chattr +i"
+    UNLOCK_CMD="sudo chattr -i"
+    CHECK_CMD="lsattr"
+  else
+    echo " 'chattr' not found. Cannot set immutability on Linux without it."
+    exit 1
+  fi
+fi
+
+if [[ "$ACTION" == "lock" ]]; then
+  echo " Locking critical configuration files..."
+  CMD="$LOCK_CMD"
+elif [[ "$ACTION" == "unlock" ]]; then
+  echo " Unlocking critical configuration files..."
+  CMD="$UNLOCK_CMD"
+else
+  echo "Usage: $0 [lock|unlock]"
+  exit 1
+fi
+
+for file in "${CRITICAL_FILES[@]}"; do
+  if [[ -f "$file" ]]; then
+    echo "Processing: $file"
+    $CMD "$file" || echo "️ Failed to modify flags for $file (permission denied?)"
+  fi
+done
+
+echo "Done. Environment state:"
+for file in "${CRITICAL_FILES[@]}"; do
+  [[ -f "$file" ]] && $CHECK_CMD "$file"
+done

package/scripts/security/lock-screen.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+
+DRY_RUN=0
+for arg in "$@"; do
+  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
+done
+_run_cmd() {
+  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
+}
+
+ui_init
+ui_header "Lock Screen"
+
+if [[ "$DRY_RUN" -eq 1 ]]; then
+  ui_info "Mode" "dry-run (no changes will be made)"
+elif [ "${DOTFILES_LOCK:-}" != "1" ]; then
+  ui_warn "Lock screen" "disabled by default"
+  ui_info "Re-run" "DOTFILES_LOCK=1"
+  exit 1
+fi
+
+case "$(dot_platform_id)" in
+  linux | wsl)
+    if command -v gsettings >/dev/null; then
+      ui_info "Enabling" "screen lock and idle timeout"
+      _run_cmd gsettings set org.gnome.desktop.screensaver lock-enabled true || true
+      _run_cmd gsettings set org.gnome.desktop.session idle-delay 300 || true
+      _run_cmd gsettings set org.gnome.desktop.screensaver lock-delay 0 || true
+    else
+      ui_err "gsettings" "not found"
+      exit 1
+    fi
+    ;;
+  macos)
+    ui_info "Enabling" "lock on sleep and screensaver (macOS)"
+    _run_cmd defaults write com.apple.screensaver askForPassword -int 1 || true
+    _run_cmd defaults write com.apple.screensaver askForPasswordDelay -int 0 || true
+    # 5-minute idle timeout
+    _run_cmd defaults -currentHost write com.apple.screensaver idleTime -int 300 || true
+    ;;
+  *)
+    ui_err "Unsupported OS" "lock screen hardening"
+    exit 1
+    ;;
+esac