Arx 0.5.3: Fix problems on Linux (fix.sh with undo), nftables detection

README.md

@@ -177,7 +177,7 @@ folder keeps its old name since the rename to Arx in 0.4.3). Reports: *Documents
 (add `DEVSEIS_SMOKE_MODEL=1` to include the model). The installer background is `app/build/dmg-background.html`,
 rendered to `dmg-background.png` / `@2x.png`.
 
-## Fix problems (macOS, app 0.5.0)
+## Fix problems (macOS since 0.5.0, Linux since 0.5.3)
 
 After the audit, the app offers **Fix** for problems it can change safely: firewall, stealth mode, Gatekeeper, malware
 definitions, installing security responses and updates automatically, guest account, analytics sharing and network time
@@ -187,6 +187,7 @@ fixes and the collector runs again, so the result is re-checked. **Undo** runs `
 ids marked `auto` in `fixes.json` ever reach the script; settings set by a configuration profile (MDM) are skipped.
 Changes that need the user (screen lock, FileVault, updates that restart, sharing, Time Machine, accounts) are kind
 `settings`: the app opens the exact System Settings page with the steps. The AI never writes or runs commands.
+**Linux** (`collectors/linux/fix.sh`, through the desktop's pkexec prompt): firewall on with incoming blocked (ufw, or firewalld; SSH allowed first if it runs), automatic security updates (unattended-upgrades via an Arx apt drop-in, or dnf-automatic), network time, guest login off, popularity-contest/whoopsie off, automatic login off (GDM, LightDM, SDDM; edited files are backed up next to the state file), and ClamAV definition updates (offered only where ClamAV runs: `requires` in `fixes.json`). Tested in Ubuntu 24.04 containers: fix, re-audit and undo restore every file and service; the packaged app runs headless with `xvfb-run`.
 Test without changing anything: `DEVSEIS_SMOKE=<folder> DEVSEIS_FIX_DRY=1 app/node_modules/.bin/electron app`.
 
 **Model per build** (`app/model-version.json`): `version` (v0.3) for the full-precision build on graphics chips with

app/main.cjs

@@ -147,7 +147,7 @@ function autoFixIds(ids) {
   const fixes = readJson('library', 'fixes.json').fixes;
   return [...new Set(ids)].filter(id => typeof id === 'string' && fixes[id] && fixes[id][OS_FAMILY] && fixes[id][OS_FAMILY].kind === 'auto');
 }
-const FIX_SCRIPT = { macos: 'fix.sh' };
+const FIX_SCRIPT = { macos: 'fix.sh', linux: 'fix.sh' };
 // Test only (smoke test): the fix script prints what it would change and changes nothing; no administrator prompt.
 const FIX_DRY = !!(process.env.DEVSEIS_SMOKE && process.env.DEVSEIS_FIX_DRY);
 const fixHistoryFile = () => path.join(app.getPath('userData'), 'fix-history.json');

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devseis-endpoint-auditor",
   "productName": "Arx",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Read-only endpoint audit for ISO 27001, GDPR and the EU AI Act, with a local AI auditor.",
   "author": {
     "name": "Devseis",

app/renderer/app.js

@@ -184,11 +184,13 @@ async function renderFixes(evidence, fixResults) {
   const name = id => (evidence.results.find(r => r.id === id) || {}).name || id;
   if (fixResults && fixResults.length) {
     $('fix-banner').innerHTML = `<b>${fixResults.some(r => r.outcome === 'undone') ? 'Undo finished' : 'Fixes finished'}</b><ul class="fix-results">${fixResults.map(r =>
-      `<li>${OUTCOME[r.outcome] || '•'} <b>${escapeHtml(name(r.id))}</b>: ${escapeHtml(r.message)}</li>`).join('')}</ul><p class="muted">The results below come from checking this Mac again after the change.</p>`;
+      `<li>${OUTCOME[r.outcome] || '•'} <b>${escapeHtml(name(r.id))}</b>: ${escapeHtml(r.message)}</li>`).join('')}</ul><p class="muted">The results below come from checking this computer again after the change.</p>`;
     $('fix-banner').classList.remove('hidden');
   } else $('fix-banner').classList.add('hidden');
 
-  const gaps = evidence.results.filter(r => r.status === 'Non-Compliant' && fixes[r.id] && fixes[r.id][os]);
+  // A fix can depend on software being present (e.g. ClamAV updates only where ClamAV runs): requires.check's result must contain requires.contains.
+  const usable = f => !f.requires || ((evidence.results.find(x => x.id === f.requires.check) || {}).actual || '').toLowerCase().includes(f.requires.contains.toLowerCase());
+  const gaps = evidence.results.filter(r => r.status === 'Non-Compliant' && fixes[r.id] && fixes[r.id][os] && usable(fixes[r.id][os]));
   const auto = gaps.filter(r => fixes[r.id][os].kind === 'auto');
   // Several checks can share one settings page and the same steps (screen lock): show them once.
   const seen = new Set();
@@ -204,9 +206,9 @@ async function renderFixes(evidence, fixResults) {
       <div class="fix-auto">${auto.map(r => { const f = fixes[r.id][os]; return `<label class="fix-item"><input type="checkbox" data-fix="${r.id}" checked>
         <span><b>${escapeHtml(f.title)}</b><br><span class="muted">${escapeHtml(f.changes)}${f.note ? ` ${escapeHtml(f.note)}` : ''}</span></span></label>`; }).join('')}</div>
       <div class="actions"><button class="primary" id="fix-selected">Fix selected (${auto.length})</button></div>` : ''}
-    ${guided.length ? `<h3>Fix in System Settings</h3><p class="muted">These need your password, a recovery key or a restart, so you make the change. Arx opens the right page.</p>
+    ${guided.length ? `<h3>${os === 'macos' ? 'Fix in System Settings' : 'Fix in Settings'}</h3><p class="muted">These need your password, a recovery key or a restart, so you make the change. Arx opens the right page.</p>
       <div class="fix-guided">${guided.map(r => { const f = fixes[r.id][os]; return `<div class="fix-item"><span><b>${escapeHtml(f.title)}</b>
-        <ol>${f.steps.map(x => `<li>${escapeHtml(x)}</li>`).join('')}</ol></span><button class="secondary" data-settings="${r.id}">Open Settings</button></div>`; }).join('')}</div>
+        <ol>${f.steps.map(x => `<li>${escapeHtml(x)}</li>`).join('')}</ol></span>${f.url ? `<button class="secondary" data-settings="${r.id}">Open Settings</button>` : ''}</div>`; }).join('')}</div>
       <p class="muted">When you are done, choose <b>Run another audit</b> to check again.</p>` : ''}
     ${undoable.length ? `<div class="undo-row"><span class="muted">Last fixes (${new Date(last.at).toLocaleString()}): ${undoable.map(id => escapeHtml(fixes[id][os].title)).join(', ')}</span>
       <button class="secondary" id="fix-undo">Undo last fixes</button></div>` : ''}`;
@@ -225,9 +227,10 @@ function confirmFix(action, ids) {
   const os = plan.os;
   pendingFix = { action, ids };
   $('fix-title').textContent = action === 'undo' ? 'Undo these fixes?' : `Fix ${ids.length} problem${ids.length > 1 ? 's' : ''}?`;
-  $('fix-intro').textContent = action === 'undo' ? 'Arx will put these settings back as they were before, then check this Mac again.'
-    : 'Arx will change these settings, then check this Mac again. You can undo each fix afterwards.';
+  $('fix-intro').textContent = action === 'undo' ? 'Arx will put these settings back as they were before, then check this computer again.'
+    : 'Arx will change these settings, then check this computer again. You can undo each fix afterwards.';
   $('fix-confirm-list').innerHTML = ids.map(id => { const f = fixes[id][os]; return `<li><b>${escapeHtml(f.title)}</b><br><span class="muted">${escapeHtml(action === 'undo' ? 'Back to the previous setting.' : f.changes)}</span></li>`; }).join('');
+  $('fix-password-note').textContent = { macos: 'macOS will ask for your administrator password.', linux: 'Your system will ask for your password (administrator rights).' }[os] || 'Your computer will ask for your administrator password.';
   $('fix-modal').classList.remove('hidden');
 }
 $('fix-cancel').addEventListener('click', () => { pendingFix = null; $('fix-modal').classList.add('hidden'); });

app/renderer/index.html

@@ -88,9 +88,9 @@
 <div class="modal hidden" id="fix-modal" role="dialog" aria-modal="true" aria-labelledby="fix-title">
   <div class="modal-box">
     <h2 id="fix-title">Fix these problems?</h2>
-    <p class="muted" id="fix-intro">Arx will change these settings, then check this Mac again. You can undo each fix afterwards.</p>
+    <p class="muted" id="fix-intro">Arx will change these settings, then check this computer again. You can undo each fix afterwards.</p>
     <ul class="fix-list" id="fix-confirm-list"></ul>
-    <p class="muted">macOS will ask for your administrator password.</p>
+    <p class="muted" id="fix-password-note">Your computer will ask for your administrator password.</p>
     <div class="actions">
       <button class="secondary" id="fix-cancel">Cancel</button>
       <button class="primary" id="fix-go">Fix now</button>

collectors/linux/audit.sh

@@ -322,7 +322,9 @@ if [ -z "$fw_name" ] && active firewalld; then
 fi
 if [ -z "$fw_name" ] && have nft && is_root; then
     ruleset=$(nft list ruleset 2>/dev/null)
-    if printf '%s' "$ruleset" | grep -q "hook input"; then
+    # Counts only if something is blocked: an input chain with policy drop, or drop/reject rules (a disabled ufw leaves
+    # empty chains with policy accept behind, which is no firewall).
+    if printf '%s' "$ruleset" | grep -q "hook input" && printf '%s' "$ruleset" | grep -qE "policy drop|[[:space:]](drop|reject)([[:space:]]|$)"; then
         fw_name=nftables
         printf '%s' "$ruleset" | grep -E "hook input.*policy drop" >/dev/null && fw_in=deny || fw_in=allow
         printf '%s' "$ruleset" | grep -E "hook output.*policy drop" >/dev/null && fw_out=deny || fw_out=allow

collectors/linux/fix.sh

@@ -0,0 +1,251 @@
+#!/bin/bash
+# Arx fixer for Linux: applies or undoes the one-click fixes in library/fixes.json, one tested function per fix.
+# The AI never writes these commands; the app only passes fix ids, and this script accepts only the ids below.
+#
+#   fix.sh apply --state FILE [--dry-run] ID [ID ...]   save the current values to FILE, then fix
+#   fix.sh undo  --state FILE [--dry-run] ID [ID ...]   put back what was saved in FILE
+#
+# Needs root (the app asks with the desktop's password prompt, pkexec). Prints one line per fix:
+#   RESULT <tab> id <tab> applied|undone|unchanged|skipped|failed <tab> message
+# State lines: id <tab> key <tab> previous value. Config files Arx edits are copied first to <state>.files/ and copied
+# back on undo; where possible Arx adds its own drop-in file instead (undo = delete it).
+set -u
+ACTION=${1:-}; shift || true
+STATE=""; DRY=0; IDS=()
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --state) STATE=$2; shift 2 ;;
+        --dry-run) DRY=1; shift ;;
+        *) IDS+=("$1"); shift ;;
+    esac
+done
+case "$ACTION" in apply|undo) ;; *) echo "usage: fix.sh apply|undo --state FILE [--dry-run] ID..." >&2; exit 2 ;; esac
+[ -n "$STATE" ] || { echo "--state is required" >&2; exit 2; }
+[ "$DRY" -eq 1 ] || [ "$(id -u)" -eq 0 ] || { echo "fix.sh must run as root" >&2; exit 3; }
+FILES="$STATE.files"
+export DEBIAN_FRONTEND=noninteractive
+
+have() { command -v "$1" >/dev/null 2>&1; }
+result() { printf 'RESULT\t%s\t%s\t%s\n' "$1" "$2" "$3"; }
+run() { if [ "$DRY" -eq 1 ]; then echo "DRY: $*" >&2; else "$@"; fi; }
+save() { [ "$DRY" -eq 1 ] || printf '%s\t%s\t%s\n' "$1" "$2" "$3" >> "$STATE"; }
+saved() { # id key -> the value saved at apply time (last one wins), only if it is one of the known safe forms
+    local v
+    v=$(awk -F'\t' -v id="$1" -v key="$2" '$1 == id && $2 == key { v = $3 } END { print v }' "$STATE" 2>/dev/null)
+    case "$v" in on|off|yes|no|1|0|unset|created|none|allow|deny|reject) printf '%s' "$v" ;;
+        /*) [[ "$v" =~ ^/[A-Za-z0-9/_.-]+$ ]] && printf '%s' "$v" ;;
+        *) printf '' ;; esac
+}
+backup() { # id file: keep a copy of a config file before Arx edits it (once per apply)
+    [ "$DRY" -eq 1 ] && return 0
+    mkdir -p "$FILES"; chmod 700 "$FILES"
+    if [ -e "$2" ]; then cp -p "$2" "$FILES/$1$(printf '%s' "$2" | tr '/' '_')"; save "$1" "file:$2" yes
+    else save "$1" "file:$2" none; fi
+}
+restore() { # id file
+    local was; was=$(awk -F'\t' -v id="$1" -v key="file:$2" '$1 == id && $2 == key { v = $3 } END { print v }' "$STATE" 2>/dev/null)
+    case "$was" in
+        yes) run cp -p "$FILES/$1$(printf '%s' "$2" | tr '/' '_')" "$2" ;;
+        none) run rm -f "$2" ;;
+        *) return 1 ;;
+    esac
+}
+svc_active() { systemctl is-active --quiet "$1" 2>/dev/null; }
+svc_enabled() { systemctl is-enabled --quiet "$1" 2>/dev/null; }
+pkg_install() { # quietly install a package with the system's package manager
+    if have apt-get; then run apt-get install -y -qq "$@" >/dev/null 2>&1
+    elif have dnf; then run dnf install -y -q "$@" >/dev/null 2>&1
+    else return 1; fi
+}
+
+# --- firewall: ufw (Debian/Ubuntu) or firewalld (RHEL/Fedora) ----------------------------------------------------
+ufw_state() { ufw status 2>/dev/null | grep -q "Status: active" && echo on || echo off; }
+ufw_in() { ufw status verbose 2>/dev/null | sed -n 's/^Default: //p' | grep -oE '(deny|reject|allow) \(incoming\)' | cut -d' ' -f1; }
+FW_ST=""; FW_IN=""; FW_A=""; FW_E=""   # state before this run's change (firewall.enabled and .inbound share it)
+firewall_fix() { # id
+    local id=$1
+    if have ufw; then
+        if [ "$ACTION" = apply ]; then
+            [ -n "$FW_ST" ] || { FW_ST=$(ufw_state); FW_IN=$(ufw_in); FW_IN=${FW_IN:-deny}; }
+            local st=$FW_ST in=$FW_IN; save "$id" ufw "$st"; save "$id" incoming "$in"
+            [ "$(ufw_state)" = on ] && [ "$(ufw_in)" = deny ] && [ "$st" = on ] && [ "$in" = deny ] && { result "$id" unchanged "The firewall was already on and blocking incoming connections."; return; }
+            # Keep remote administration working: allow SSH before blocking incoming connections.
+            if svc_active ssh || svc_active sshd; then run ufw allow OpenSSH >/dev/null 2>&1 || run ufw allow 22/tcp >/dev/null 2>&1; fi
+            [ "$(ufw_state)" = on ] && [ "$(ufw_in)" = deny ] && { result "$id" applied "Firewall (ufw) is on and blocking incoming connections."; return; }
+            run ufw default deny incoming >/dev/null && run ufw default allow outgoing >/dev/null && run ufw --force enable >/dev/null \
+                && result "$id" applied "Firewall (ufw) turned on: incoming connections are blocked, SSH stays allowed if it was running." \
+                || result "$id" failed "Could not turn on ufw."
+        else
+            local st in; st=$(saved "$id" ufw); in=$(saved "$id" incoming); [ -n "$st" ] || { result "$id" skipped "Nothing saved to undo."; return; }
+            [ -n "$in" ] && run ufw default "$in" incoming >/dev/null
+            [ "$st" = off ] && run ufw --force disable >/dev/null
+            result "$id" undone "Firewall set back to ${st}, incoming ${in:-unchanged}."
+        fi
+    elif have firewall-cmd; then
+        if [ "$ACTION" = apply ]; then
+            [ -n "$FW_A" ] || { svc_active firewalld && FW_A=on || FW_A=off; svc_enabled firewalld && FW_E=on || FW_E=off; }
+            local a=$FW_A e=$FW_E
+            save "$id" firewalld "$a"; save "$id" firewalld_boot "$e"
+            [ "$a" = on ] && [ "$e" = on ] && { result "$id" unchanged "firewalld was already running."; return; }
+            run systemctl enable --now firewalld >/dev/null 2>&1 && result "$id" applied "Firewall (firewalld) turned on and started at boot." || result "$id" failed "Could not start firewalld."
+        else
+            local a e; a=$(saved "$id" firewalld); e=$(saved "$id" firewalld_boot); [ -n "$a" ] || { result "$id" skipped "Nothing saved to undo."; return; }
+            [ "$a" = off ] && run systemctl stop firewalld >/dev/null 2>&1
+            [ "$e" = off ] && run systemctl disable firewalld >/dev/null 2>&1
+            result "$id" undone "firewalld set back to $a."
+        fi
+    else
+        result "$id" skipped "No firewall tool is installed. Install ufw (sudo apt install ufw) or firewalld, then try again."
+    fi
+}
+fix_firewall_enabled() { firewall_fix firewall.enabled; }
+fix_firewall_inbound() { firewall_fix firewall.inbound; }
+
+# --- automatic security updates -------------------------------------------------------------------------------
+APT_DROPIN=/etc/apt/apt.conf.d/52arx-auto-upgrades
+fix_gdpr_auto_updates() {
+    local id=gdpr.auto_updates
+    if have apt-get; then
+        if [ "$ACTION" = apply ]; then
+            local uu pkg=no; uu=$(apt-config dump 2>/dev/null | awk -F'"' '/^APT::Periodic::Unattended-Upgrade /{ print $2 }')
+            dpkg-query -W -f='${Status}' unattended-upgrades 2>/dev/null | grep -q "install ok installed" && pkg=yes
+            save $id package $pkg
+            [ "$uu" = 1 ] && [ $pkg = yes ] && { result $id unchanged "Automatic security updates were already on."; return; }
+            [ $pkg = yes ] || [ "$DRY" -eq 1 ] || pkg_install unattended-upgrades || { result $id failed "Could not install unattended-upgrades."; return; }
+            [ -e "$APT_DROPIN" ] && save $id dropin yes || save $id dropin created
+            if [ "$DRY" -eq 1 ]; then echo "DRY: write $APT_DROPIN" >&2
+            else printf '// Added by Arx (undo removes this file)\nAPT::Periodic::Update-Package-Lists "1";\nAPT::Periodic::Unattended-Upgrade "1";\n' > "$APT_DROPIN"; fi
+            result $id applied "Security updates now install automatically every day (unattended-upgrades)."
+        else
+            [ "$(saved $id dropin)" = created ] || { result $id skipped "Nothing saved to undo."; return; }
+            run rm -f "$APT_DROPIN"
+            if [ "$(saved $id package)" = no ]; then run apt-get purge -y -qq unattended-upgrades >/dev/null 2>&1; fi
+            result $id undone "Automatic updates set back as they were$( [ "$(saved $id package)" = no ] && echo " (unattended-upgrades removed again)")."
+        fi
+    elif have dnf; then
+        local conf=/etc/dnf/automatic.conf
+        if [ "$ACTION" = apply ]; then
+            svc_enabled dnf-automatic-install.timer && { save $id timer on; result $id unchanged "Automatic updates were already on."; return; }
+            save $id timer off
+            [ -e "$conf" ] || [ "$DRY" -eq 1 ] || pkg_install dnf-automatic || { result $id failed "Could not install dnf-automatic."; return; }
+            run systemctl enable --now dnf-automatic-install.timer >/dev/null 2>&1 \
+                && result $id applied "Updates now download and install automatically (dnf-automatic-install timer)." || result $id failed "Could not enable dnf-automatic."
+        else
+            [ "$(saved $id timer)" = off ] || { result $id skipped "Nothing saved to undo."; return; }
+            run systemctl disable --now dnf-automatic-install.timer >/dev/null 2>&1; result $id undone "Automatic updates turned off again."
+        fi
+    else
+        result $id skipped "Unknown package manager."
+    fi
+}
+
+# --- time synchronisation -------------------------------------------------------------------------------------
+fix_gdpr_time_sync() {
+    local id=gdpr.time_sync
+    have timedatectl || { result $id skipped "timedatectl is not available."; return; }
+    if [ "$ACTION" = apply ]; then
+        local now; now=$(timedatectl show -p NTP --value 2>/dev/null)
+        [ "$now" = yes ] && { result $id unchanged "Network time was already on."; return; }
+        if run timedatectl set-ntp true 2>/dev/null; then save $id ntp no; result $id applied "The clock now sets itself from network time servers."
+        else result $id failed "Could not turn on network time (is systemd-timesyncd or chrony installed?)."; fi
+    else
+        [ "$(saved $id ntp)" = no ] || { result $id skipped "Nothing saved to undo."; return; }
+        run timedatectl set-ntp false 2>/dev/null; result $id undone "Network time turned off again."
+    fi
+}
+
+# --- guest login ----------------------------------------------------------------------------------------------
+fix_gdpr_guest_account() {
+    local id=gdpr.guest_account changed=0
+    if [ "$ACTION" = apply ]; then
+        local f
+        while IFS= read -r f; do
+            [ -n "$f" ] || continue
+            backup $id "$f"; run sed -i -E 's/^([[:space:]]*allow-guest[[:space:]]*=[[:space:]]*)true/\1false/I' "$f"; changed=1
+        done < <(grep -rlsiE '^[[:space:]]*allow-guest[[:space:]]*=[[:space:]]*true' /etc/lightdm)
+        local shell; shell=$(awk -F: '$1 == "guest" { print $7 }' /etc/passwd)
+        if [ -n "$shell" ] && ! [[ "$shell" =~ (nologin|false)$ ]]; then
+            save $id guest_shell "$shell"; run usermod -s /usr/sbin/nologin guest; changed=1
+        fi
+        [ $changed -eq 1 ] && result $id applied "Guest login turned off." || result $id unchanged "No guest login was enabled."
+    else
+        local any=0
+        while IFS= read -r f; do restore $id "$f" && any=1; done < <(awk -F'\t' -v id="$id" '$1 == id && $2 ~ /^file:/ { print substr($2, 6) }' "$STATE" 2>/dev/null | sort -u)
+        local sh; sh=$(saved $id guest_shell); [ -n "$sh" ] && { run usermod -s "$sh" guest; any=1; }
+        [ $any -eq 1 ] && result $id undone "Guest login set back as it was." || result $id skipped "Nothing saved to undo."
+    fi
+}
+
+# --- usage reporting ------------------------------------------------------------------------------------------
+fix_gdpr_telemetry() {
+    local id=gdpr.telemetry changed=0 pc=/etc/popularity-contest.conf
+    if [ "$ACTION" = apply ]; then
+        if grep -qsE '^PARTICIPATE="?yes' "$pc"; then backup $id "$pc"; run sed -i 's/^PARTICIPATE=.*/PARTICIPATE="no"/' "$pc"; changed=1; fi
+        if svc_active whoopsie || svc_enabled whoopsie; then save $id whoopsie on; run systemctl disable --now whoopsie >/dev/null 2>&1; changed=1; fi
+        [ $changed -eq 1 ] && result $id applied "Usage and error reporting turned off." || result $id unchanged "Usage reporting was already off."
+    else
+        local any=0
+        restore $id "$pc" && any=1
+        [ "$(saved $id whoopsie)" = on ] && { run systemctl enable --now whoopsie >/dev/null 2>&1; any=1; }
+        [ $any -eq 1 ] && result $id undone "Usage reporting set back as it was." || result $id skipped "Nothing saved to undo."
+    fi
+}
+
+# --- automatic login ------------------------------------------------------------------------------------------
+fix_account_unique_login() { # turns off automatic login only; shared accounts need a person to decide
+    local id=account.unique_login changed=0 f
+    if [ "$ACTION" = apply ]; then
+        for f in /etc/gdm3/custom.conf /etc/gdm/custom.conf; do
+            if grep -qsiE '^[[:space:]]*AutomaticLoginEnable[[:space:]]*=[[:space:]]*true' "$f"; then
+                backup $id "$f"; run sed -i -E 's/^([[:space:]]*AutomaticLoginEnable[[:space:]]*=[[:space:]]*).*/\1false/I' "$f"; changed=1
+            fi
+        done
+        for f in /etc/lightdm/lightdm.conf /etc/lightdm/lightdm.conf.d/*.conf; do
+            if [ -f "$f" ] && grep -qsE '^[[:space:]]*autologin-user[[:space:]]*=[[:space:]]*[^[:space:]]' "$f"; then
+                backup $id "$f"; run sed -i -E 's/^([[:space:]]*autologin-user[[:space:]]*=).*/\1/' "$f"; changed=1
+            fi
+        done
+        for f in /etc/sddm.conf /etc/sddm.conf.d/*.conf; do
+            if [ -f "$f" ] && awk '/^\[Autologin\]/ { a = 1; next } /^\[/ { a = 0 } a && /^[[:space:]]*User[[:space:]]*=[[:space:]]*[^[:space:]]/ { f = 1 } END { exit !f }' "$f"; then
+                backup $id "$f"; run sed -i -E '/^\[Autologin\]/,/^\[/ s/^([[:space:]]*User[[:space:]]*=).*/\1/' "$f"; changed=1
+            fi
+        done
+        [ $changed -eq 1 ] && result $id applied "Automatic login turned off: everyone signs in with their own password. Shared accounts (if any) still need a decision by a person." \
+            || result $id unchanged "Automatic login was already off. Shared accounts need a decision by a person (see the report)."
+    else
+        local any=0
+        while IFS= read -r f; do restore $id "$f" && any=1; done < <(awk -F'\t' -v id="$id" '$1 == id && $2 ~ /^file:/ { print substr($2, 6) }' "$STATE" 2>/dev/null | sort -u)
+        [ $any -eq 1 ] && result $id undone "Login settings put back as they were." || result $id skipped "Nothing saved to undo."
+    fi
+}
+
+# --- ClamAV (only when it is the malware protection in use) ------------------------------------------------------
+fix_malware_signatures() {
+    local id=malware.signatures
+    [ "$ACTION" = undo ] && { result $id unchanged "Malware definition updates are not undone."; return; }
+    have freshclam || { result $id skipped "ClamAV is not installed."; return; }
+    if svc_active clamav-freshclam; then run systemctl restart clamav-freshclam >/dev/null 2>&1 && result $id applied "Asked ClamAV to download the latest malware definitions." && return; fi
+    run freshclam --quiet >/dev/null 2>&1 && result $id applied "Malware definitions (ClamAV) updated." || result $id failed "freshclam could not update (check the internet connection)."
+}
+fix_malware_signature_updates() {
+    local id=malware.signature_updates
+    have freshclam || { result $id skipped "ClamAV is not installed."; return; }
+    if [ "$ACTION" = apply ]; then
+        svc_active clamav-freshclam && { save $id freshclam on; result $id unchanged "Definition updates were already automatic."; return; }
+        save $id freshclam off
+        run systemctl enable --now clamav-freshclam >/dev/null 2>&1 && result $id applied "ClamAV now updates its malware definitions automatically." || result $id failed "Could not start clamav-freshclam."
+    else
+        [ "$(saved $id freshclam)" = off ] || { result $id skipped "Nothing saved to undo."; return; }
+        run systemctl disable --now clamav-freshclam >/dev/null 2>&1; result $id undone "Automatic definition updates turned off again."
+    fi
+}
+
+# --- main ---------------------------------------------------------------------------------------------------
+[ "$DRY" -eq 1 ] || { touch "$STATE"; chmod 600 "$STATE"; }
+for id in "${IDS[@]}"; do
+    case "$id" in
+        firewall.enabled|firewall.inbound|gdpr.auto_updates|gdpr.time_sync|gdpr.guest_account|gdpr.telemetry|account.unique_login|malware.signatures|malware.signature_updates)
+            "fix_${id//./_}" ;;
+        *) result "$id" skipped "Arx has no automatic fix for this check." ;;
+    esac
+done

index.html

@@ -3,7 +3,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
-  <meta name="description" content="Arx: a free security audit for your Mac, Windows or Linux computer. 70 checks in about a minute, offline, mapped to ISO 27001, GDPR and the EU AI Act, with one-click fixes on Mac. Nothing is uploaded.">
+  <meta name="description" content="Arx: a free security audit for your Mac, Windows or Linux computer. 70 checks in about a minute, offline, mapped to ISO 27001, GDPR and the EU AI Act, with one-click fixes on Mac and Linux. Nothing is uploaded.">
   <meta name="theme-color" content="#ed2939">
   <title>Arx · Security audit for your computer</title>
   <link rel="icon" href="app/build/icon.png">
@@ -33,7 +33,7 @@
     <section class="wrap hero">
       <p class="eyebrow"><img src="app/build/icon.png" alt="">Arx security audit</p>
       <h1>Is your computer secure?<br><span class="grad">Find out in a minute.</span></h1>
-      <p class="lead">A free audit of your Mac, Windows or Linux computer: <b><span data-count>70</span> checks</b> mapped to <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>. A small AI on your computer writes the report, and on a Mac Arx can <b>fix problems for you</b>. It runs offline. <u>Nothing is uploaded.</u></p>
+      <p class="lead">A free audit of your Mac, Windows or Linux computer: <b><span data-count>70</span> checks</b> mapped to <b>ISO 27001</b>, <b>GDPR</b> and the <b>EU AI Act</b>. A small AI on your computer writes the report, and on Mac and Linux Arx can <b>fix problems for you</b>. It runs offline. <u>Nothing is uploaded.</u></p>
 
       <div class="device-card" id="deviceCard">
         <span class="device-icon" id="deviceIcon">💻</span>
@@ -56,7 +56,7 @@
         <label class="btn btn-lg" for="reportFile" title="Open the …-evidence.json file Arx saves next to each report">Open a report</label>
         <input type="file" id="reportFile" accept=".json,application/json" hidden>
       </div>
-      <p class="tiny muted" id="heroMeta">Free · open source · version 0.5.2</p>
+      <p class="tiny muted" id="heroMeta">Free · open source · version 0.5.3</p>
     </section>
 
     <section class="wrap">
@@ -78,7 +78,7 @@
       <ol class="steps">
         <li><span class="step-n">1</span><div><b>Download and open Arx</b><p class="muted">One app for your system. Admin rights let it read every setting; without them, a few checks are skipped.</p></div></li>
         <li><span class="step-n">2</span><div><b>Run the audit</b><p class="muted">The audit only reads settings: nothing changes unless you later click Fix. The first run downloads the AI once; after that it works offline.</p></div></li>
-        <li><span class="step-n">3</span><div><b>Get your report and fix</b><p class="muted">A score, your biggest gaps and how to fix each one, as a PDF. On a Mac, click <b>Fix</b> and Arx changes the setting for you, or opens the right System Settings page. Every fix can be undone.</p></div></li>
+        <li><span class="step-n">3</span><div><b>Get your report and fix</b><p class="muted">A score, your biggest gaps and how to fix each one, as a PDF. On Mac and Linux, click <b>Fix</b> and Arx changes the setting for you (on a Mac it also opens the right System Settings page for the rest). Every fix can be undone.</p></div></li>
       </ol>
     </section>
 
@@ -95,7 +95,7 @@
     </section>
 
     <section class="wrap section" id="download">
-      <div class="section-head"><h2>Download Arx</h2><span class="tiny muted" id="dlVersion">Version 0.5.2</span></div>
+      <div class="section-head"><h2>Download Arx</h2><span class="tiny muted" id="dlVersion">Version 0.5.3</span></div>
       <div class="dl-grid">
         <article class="dl-card" data-os="mac">
           <span class="ribbon ribbon-you hidden">YOUR SYSTEM</span>

library/fixes.json

@@ -9,6 +9,13 @@
         "changes": "Turns on the macOS firewall, which blocks unwanted incoming connections.",
         "note": "Apps you already allowed keep working.",
         "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Turn on the firewall",
+        "changes": "Turns on the firewall (ufw, or firewalld on Red Hat-type systems) and blocks incoming connections. If remote login (SSH) is running, it stays allowed.",
+        "note": "Outgoing connections are not affected.",
+        "undo": true
       }
     },
     "firewall.inbound": {
@@ -18,6 +25,13 @@
         "changes": "Turns on the firewall and stealth mode, so the Mac does not answer probes from other computers on the network.",
         "note": "Other computers can no longer ping this Mac.",
         "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Block incoming connections",
+        "changes": "Turns on the firewall (ufw or firewalld) with incoming connections blocked by default. If remote login (SSH) is running, it stays allowed.",
+        "note": "Programs that serve other computers (for example a local web server) may need a firewall rule.",
+        "undo": true
       }
     },
     "malware.service": {
@@ -36,6 +50,17 @@
         "changes": "Installs the latest XProtect malware definitions from Apple.",
         "note": "An update: there is nothing to undo.",
         "undo": false
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Update malware definitions",
+        "changes": "Downloads the latest ClamAV malware definitions (freshclam).",
+        "note": "An update: there is nothing to undo.",
+        "undo": false,
+        "requires": {
+          "check": "malware.antivirus",
+          "contains": "ClamAV"
+        }
       }
     },
     "malware.signature_updates": {
@@ -45,6 +70,17 @@
         "changes": "Turns on 'Install Security Responses and system files' in Software Update, so malware definitions stay current.",
         "note": "",
         "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Update malware definitions automatically",
+        "changes": "Starts the ClamAV definition updater (clamav-freshclam) and runs it at every start-up.",
+        "note": "",
+        "undo": true,
+        "requires": {
+          "check": "malware.antivirus",
+          "contains": "ClamAV"
+        }
       }
     },
     "gdpr.auto_updates": {
@@ -54,6 +90,13 @@
         "changes": "Turns on checking for, downloading and installing macOS updates and security responses automatically.",
         "note": "macOS may restart overnight to finish an update; it warns first.",
         "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Turn on automatic security updates",
+        "changes": "Installs and turns on unattended-upgrades (Ubuntu, Debian) or dnf-automatic (Red Hat-type systems), so security updates install every day.",
+        "note": "Undo turns it off again and removes the tool if Arx installed it.",
+        "undo": true
       }
     },
     "gdpr.guest_account": {
@@ -63,6 +106,13 @@
         "changes": "Turns off guest login and guest access to shared folders.",
         "note": "",
         "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Turn off guest login",
+        "changes": "Turns off the guest session on the login screen and the login shell of a 'guest' account.",
+        "note": "",
+        "undo": true
       }
     },
     "gdpr.telemetry": {
@@ -72,6 +122,13 @@
         "changes": "Turns off 'Share Mac Analytics' and 'Share with app developers'.",
         "note": "",
         "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Stop usage reporting",
+        "changes": "Turns off popularity-contest and the whoopsie error reporter.",
+        "note": "",
+        "undo": true
       }
     },
     "gdpr.time_sync": {
@@ -81,6 +138,13 @@
         "changes": "Turns on 'Set time and date automatically' from Apple's time server, so logs have correct times.",
         "note": "",
         "undo": true
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Set the time automatically",
+        "changes": "Turns on network time (timedatectl set-ntp true), so logs have correct times.",
+        "note": "",
+        "undo": true
       }
     },
     "screen_lock.enabled": {
@@ -240,6 +304,13 @@
           "Set 'Automatically log in as' to Off (at the bottom of the page).",
           "Give each person their own account; remove or rename shared accounts such as office or admin, keeping one named IT administrator."
         ]
+      },
+      "linux": {
+        "kind": "auto",
+        "title": "Turn off automatic login",
+        "changes": "Turns off automatic login (GDM, LightDM or SDDM), so everyone signs in with their own password.",
+        "note": "Shared accounts are not changed: a person decides which to remove.",
+        "undo": true
       }
     }
   }