Custom bash script execution

[snw7]

Great Project! I really like it. I think another great feature would be for the user to select a custom bash script that will execute on trigger.
This would allow for great customization :)

What do you think?

[Lennolium]

I really appreciate your kind words!

I will add your idea to the roadmap of coming features. Right now swiftguard is not running with sudo privilegies and thus the executed script would not too. Would you want the script to execute "sudo" stuff or not? :)

Furthermore, I need to consider security, as an attacker could replace the custom script (e.g. in your users documents dir) with some evil script.

[snw7]

I think sudo as an option would be great. For my use case sudo isn't needed though :)

A way around the security issue you are describing might be to sign the bash script with a developer's certificate? Or what about swiftGuard reading the script and then executing an internal copy. This way one could prevent tampering with the script. You could also hash it and store the hash value in a db. Only if it matches execution is allowed.

I think the moment, that an attacker has access to the victims shell it is too late already. And with apple script one could also switch the script via the gui and simply select another one + I think the whole purpose of swiftGuard is to protect from third party physical access. If the attacker is already in the shell it doesn't matter anymore if he's got physical access or not as he can do whatever he wants on the device anyways.

Is there any way to contribute to this repo via PRs? Or do you prefer to write the whole code yourself? :)

[Lennolium]

I can only repeat myself: great ideas! I think to read-in the script is the best way, maybe using the hash too.
Good points tho!

Please feel free to contribute via PRs, every aspect of help from the community is appreciated. For me it's (mostly) new, that people contribute, so tell me when I can do something to help you. Also maybe wait some days before starting dev, as I'll push a really big commit the next days (So you do not repeat work, which is already done).
Cheers mate 😇

[snw7]

Thanks! Yeah, for sure. I am also kind of busy with some other projects of mine currently. But I'll try to make some time soon :) I already looked at your code briefly. Looks really good! Cheers

[snw7]

What do you think about adding optional push notifications, when the script is triggered? Or would that be risky if an attacker gets hold of the device? These push notifications could be custom to disguise. So only the devices owner knows what to do, if it was accidental.

[Lennolium]

I really love that feature, but afaik push notifications are not private by design. Still in case of an attack, I think your privacy violated is a minor problem. So definitely I will implement this later. At this moment, I've already finished an E-Mail notification system with an additional feature to take a photo of the attacker with the front-camera, desktop and mobile version, dark-mode, ... See below for a small preview 😊

Preview image (Click me!)

[snw7]

Nice!

[snw7]

Just out of interest: how are you sending the emails? Are you running a dedicated server that send the emails for all Users? Or does it use the users mailbox on the device?

[Lennolium]

The user has to provide his personal email account details and emails are then sent via smtp. This way, we add no dependency to swiftGuard and also privacy-wise it is better. The user can also specify to which email address(es) the warn email is sent :)

[snw7]

What do you think about integrating services like ntfy.sh for notifications? Their API is really simple to use. This would enable push notifications directly to the users other devices.

[Lennolium]

Will consider this!

[snw7]

Another idea I had was to also monitor the current charging status of the device. My Mac for example has MagSafe - it is better for the device if the power cable is "ripped out" than a usb cord. I think the power cable also ties the device to a location really well - therefore securing the device from theft.
What do you think?

[Lennolium]

Now its getting crazy 😅
I've already written that functionality too, because its also really easy go get the charging state form the system_profiler:
In normal mode we allow to connect the charger, disconnecting the charger triggers the alarm. In strict mode connecting and disconnecting the charger triggers alarm.

Please keep on suggesting features, we are on the same wavelength regarding that 😊

[snw7]

Really nice! My Mac for example can be charged via usb c or mag safe. (There are 4 different ports to charge through theoretically😅) It would be interesting to test if it also triggers the alarm if you switch the port it is charging through.
Otherwise one could connect a second cable that is connected to a power bank and then disconnect the original cable. This way the device is continuously charging but still becomes portable without triggering the app.
Still a minor risk but interesting to think about😅

[snw7]

For enhanced security one could also add: disarming the software is only possible with biometric authentication - f.e: Touch ID or with a second factor like the MS Auth App.

[snw7]

I just noticed a possible error/security risk on the application. The shutdown currently isn't forced. For example iTerm can block the shutdown process if windows are currently open. This way the laptop remains unlocked and up. It would be great to have log out as a failover, in case the shutdown doesn't quite go through. And also forced shutdown :)

[Lennolium]

Yes you are right! Right now its implemented to fallback to sleep/lock if shutdown doesnt work. But maybe change this to shutdown->logout->sleep
Thanks mate! :)

[snw7]

Yes you are right! Right now its implemented to fallback to sleep/lock if shutdown doesnt work. But maybe change this to shutdown->logout->sleep Thanks mate! :)

At least for me that doesnt work. If f.E. Mail blocks the shutdown it just stops there (unlocked).

[Lennolium]

Hey, I need to test that. Other applications shouldnt block the shutdown process, but with each macOS update, this behavior is changed for my experience :/ Maybe I need to implement another action runner, which has admin rights and is able to force shutdown, no matter if apps are blocking ...

[snw7]

How is it currently going? I'd love to use the mail feature you previewed :)

[Lennolium]

Thanks for your patience! Sorry I was very busy and forget to push most changes. Also I've completely rewritten the GUI (90% done), so big changes are waiting for you :)