I have a machine with the network interface enp0s3 which is assigned the IPv4 address 192.168.20.254. Furthermore, on another machine there is a DNS server listening on the IPv4 address 192.168.20.10. The network between the two machines works without issues, the machines can reach each other. On both machines, IPv6 is completely disabled via kernel parameter ipv6.disable=1. On the first machine, I have the following nftables ruleset:

root@charon /etc/network # nft list ruleset
table ip t_IP {
        chain output-route {
                type route hook output priority mangle; policy accept;
                ip daddr 192.168.20.10 meta nftrace set 1
        }

        chain output-filter {
                type filter hook output priority filter; policy accept;
                ip daddr 192.168.20.10 meta nftrace set 1
        }

        chain output-nat {
                type nat hook output priority 100; policy accept;
                ip daddr 192.168.20.10 meta nftrace set 1
        }

        chain postrouting-filter {
                type filter hook postrouting priority filter; policy accept;
                ip daddr 192.168.20.10 meta nftrace set 1
        }

        chain postrouting-nat {
                type nat hook postrouting priority srcnat; policy accept;
                ip daddr 192.168.20.10 meta nftrace set 1
        }
}

The purpose of this ruleset is to accept all packets no matter what, and to be able to trace all packets that originate at the machine through all chains that are part of the packet output path. I have put meta nftrace set 1 in every chain because I don't know which the first chain is that the packets traverse. To avoid too much noise, tracing is enabled only for DNS packets (which here can easily be identified either by their destination IP address or their destination port; the above ruleset does the former). nft monitor trace shows the following output when I enter host blahblah in a second terminal on the machine (I have inserted a blank line to add a bit of structure):

trace id b00605cc ip t_IP output-route packet: oif "enp0s3" ip saddr 192.168.20.254 ip daddr 192.168.20.10 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 8386 ip length 67 udp sport 37348 udp dport 53 udp length 47 @th,64,96 0x69ea01000001000000000000
trace id b00605cc ip t_IP output-route rule ip daddr 192.168.20.10 meta nftrace set 1 (verdict continue)
trace id b00605cc ip t_IP output-route verdict continue
trace id b00605cc ip t_IP output-route policy accept
trace id b00605cc ip t_IP output-filter packet: oif "enp0s3" ip saddr 192.168.20.254 ip daddr 192.168.20.10 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 8386 ip length 67 udp sport 37348 udp dport 53 udp length 47 @th,64,96 0x69ea01000001000000000000
trace id b00605cc ip t_IP output-filter rule ip daddr 192.168.20.10 meta nftrace set 1 (verdict continue)
trace id b00605cc ip t_IP output-filter verdict continue
trace id b00605cc ip t_IP output-filter policy accept
trace id b00605cc ip t_IP postrouting-filter packet: oif "enp0s3" ip saddr 192.168.20.254 ip daddr 192.168.20.10 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 8386 ip length 67 udp sport 37348 udp dport 53 udp length 47 @th,64,96 0x69ea01000001000000000000
trace id b00605cc ip t_IP postrouting-filter rule ip daddr 192.168.20.10 meta nftrace set 1 (verdict continue)
trace id b00605cc ip t_IP postrouting-filter verdict continue
trace id b00605cc ip t_IP postrouting-filter policy accept

trace id 4e72ea91 ip t_IP output-route packet: oif "enp0s3" ip saddr 192.168.20.254 ip daddr 192.168.20.10 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 42220 ip length 50 udp sport 44559 udp dport 53 udp length 30 @th,64,96 0x395901000001000000000000
trace id 4e72ea91 ip t_IP output-route rule ip daddr 192.168.20.10 meta nftrace set 1 (verdict continue)
trace id 4e72ea91 ip t_IP output-route verdict continue
trace id 4e72ea91 ip t_IP output-route policy accept
trace id 4e72ea91 ip t_IP output-filter packet: oif "enp0s3" ip saddr 192.168.20.254 ip daddr 192.168.20.10 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 42220 ip length 50 udp sport 44559 udp dport 53 udp length 30 @th,64,96 0x395901000001000000000000
trace id 4e72ea91 ip t_IP output-filter rule ip daddr 192.168.20.10 meta nftrace set 1 (verdict continue)
trace id 4e72ea91 ip t_IP output-filter verdict continue
trace id 4e72ea91 ip t_IP output-filter policy accept
trace id 4e72ea91 ip t_IP postrouting-filter packet: oif "enp0s3" ip saddr 192.168.20.254 ip daddr 192.168.20.10 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 42220 ip length 50 udp sport 44559 udp dport 53 udp length 30 @th,64,96 0x395901000001000000000000
trace id 4e72ea91 ip t_IP postrouting-filter rule ip daddr 192.168.20.10 meta nftrace set 1 (verdict continue)
trace id 4e72ea91 ip t_IP postrouting-filter verdict continue
trace id 4e72ea91 ip t_IP postrouting-filter policy accept

The trace shows how two different packets flow through the chains. Both packets are typical DNS client packets that originate at the local machine (192.168.20.254, random non-privileged source port) and go to the DNS server (192.168.20.10, destination port 53). Each packet first reaches the output hook. At that hook, it first traverses the route chain, then the filter chain, according to the priorities these chains are registered at. But no packet ever goes through the nat chain at the output hook. **Why does this not happen?** Likewise, each packet, after having left the output hook, reaches the postrouting hook and traverses the filter chain that is registered there. But no packet ever traverses the nat chain that is also registered at the postrouting hook. **Again, why is this not the case?** The documentation (in section "Verdict Statement") says that an accept verdict for a packet stops the evaluation of further rules in the current chain, but that the packet nonetheless traverses later chains that are registered at the same hook and all chains at later hooks, until it meets another verdict which is *really* final, e.g. a drop verdict. This means that an accept verdict is final only for the chain scope, but not for the whole hook scope or the global scope. In contrast, a drop verdict is final and immediately stops *any* further evaluation. Since every chain in the ruleset above has an accept policy and no explicit verdicts, at least the first packet of every connection should go through the nat chains at the output or postrouting hook. But that is not the case. What am I missing?

If I have following Libvirt hook in /etc/libvirt/hooks/qemu.d/hook.sh

#!/usr/bin/env bash

if [[ $1 == "SEARCH_FOR_ME" ]]; then
    while true; do
        sleep 1
    done
fi

bash /etc/libvirt/hooks/qemu.d/hook.sh SEARCH_FOR_ME &
disown $!

touch /tmp/test123

exit 0

Now when I start any of my VMs this hook gets called and what I expected to happen is that a new process will be spawned and will run alongside VM. What actually happens is that libvirt for some reason knows that forked process is still running. Note that /tmp/test123 is being created. It seems that original bash script is being suspended.

2438 root        20   0     0     0     0 Z   0.0  0.0  0:00.00 bash
 2439 root        20   0  4396  3200  2944 S   0.0  0.0  0:00.04 bash /etc/libvirt/hooks/qemu.d/hook.sh SEARCH_FOR_ME

Also while running the same hook in my terminal I can't observe the same behavior. nohup works the same way and doesn't fix this issue. My system:

Artix Linux (OpenRC 0.53)
Hyprland WM (Wayland)
Libvirtd + Virt Manager

How can I run a command before apt-get starts to download a package? I know about the dpkg pre-invoke hook ( https://unix.stackexchange.com/questions/76294/hook-a-script-to-apt-get ), but that seems to be run after the download. $ apt-get update Get: 11 http://security.debian.org/ wheezy/updates/main qemu amd64 1.1.2+dfsg-6a+deb7u7 [115 kB] Fetched 70.9 MB in 10s (6,776 kB/s) refreshing freenet index --2015-05-19 15:55:25-- http://127.0.0.1:8888/freenet:USK@oRy7ltZLJM-w-kcOBdiZS1pAA8P-BxZ3BPiiqkmfk0E,6a1KFG6S-Bwp6E-MplW52iH~Y3La6GigQVQDeMjI6rg,AQACAAE/deb.mempo.org/-42/ What we need is to run a command *before* the download. More exactly: The script must run after calling apt-get but before apt-get accesses any online resource. Is there something like a Pre-Download hook? It is important that the installation can be done without having to replace the script apt-get (and without doing anything else which could be undone by an update).

Say, I create a new repo, and try to commit. Git shows me

*** Please tell me who you are.

Run

  git config --global user.email "you@example.com"
  git config --global user.name "Your Name"

to set your account's default identity.
Omit --global to set the identity only in this repository.

Without reading the last line, I run the two lines suggested by git (with --global) and happily commit. A week later I create a new repo for a completely unrelated project where I'd need to commit under a different user.email. Without even thinking about user.email, I try to commit, it goes through and I push to the origin. The above happened to me twice and made me think whether there is a way to disallow git config --global. For example, if I run

git config --global user.email "you@example.com"

I'd like bash not to run the command and show me a warning, but when I run

git config user.email "you@example.com"

I'd like it to go through. Is it possible?

OS Version: 5.9.14-arch1-1 Kernel I am trying to figure out how I can load the whole / directory into the RAM when starting up. I found a little helper here: https://github.com/arcmags/ramroot So, when the ramroot hook starts to run, it will set up the zram module: modprobe zram Next, we will allocate some memory with... zramctl -f -s 10M When my OS is started up, this command works fine and I can mount the zram0 device. But in this boot mode, I get this error: /dev/zram0: failed to set disksize (.... bytes): Cannot allocate memory Does anyone know where the issue may be? Are there modules missing to get the operation done? This is my current hook order: HOOKS=(base udev ramroot autodetect modconf block filesystems keyboard fsck)

There is a hook function *socketHook.c* that intercepts *socket()* calls: #include int socket(int domain, int type, int protocol) { printf("socket() has been intercepted!\n"); return 0; } gcc -c -fPIC socketHook.c gcc -shared -o socketHook.so socketHook.o And a simple program *getpwuid.c* (1) that just invokes the getpwuid() function: #include int main() { getpwuid(0); return 0; } gcc getpwuid.c -o getpwuid *getpwuid()* internally makes a *socket()* call. On CentOS: $ strace -e trace=socket ./getpwuid socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3 socket(AF_UNIX, SOCK_STREAM, 0) = 4 On Ubuntu: $ strace -e trace=socket ./getpwuid socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5 socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 5 When running (1), *socket()* is intercepted on CentOS, but not on Ubuntu. **CentOS.** *printf()* from *socketHook.c* is present: $ uname -a Linux centos-stream 4.18.0-301.1.el8.x86_64 #1 SMP Tue Apr 13 16:24:22 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ LD_PRELOAD=$(pwd)/socketHook.so ./getpwuid socket() has been intercepted! **Ubuntu**(Xubuntu 20.04). *printf()* from *socketHook.c* is NOT present: $ uname -a Linux ibse-VirtualBox 5.8.0-50-generic #56~20.04.1-Ubuntu SMP Mon Apr 12 21:46:35 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux $ LD_PRELOAD=$(pwd)/socketHook.so ./getpwuid $ So my question is: 1. What does it depend on? I think this is affected by the fact that *socket()* is not called directly from the executable, but from getpwuid(), which in turn is called, if I understand correctly, from libc.so 2. How to achieve the same behavior in CentOS as in Ubuntu? I don't want intercept indirect calls from libc

I have next record in crontab -e, running with user root.

@reboot /usr/bin/curl --silent --insecure -v -X GET https://?key=9d722304320de0b074d8da74bf680874&mes= 'nik-pc was rebooted or started!'

But it not work! p.s. if I run the command in the terminal - everything is fine. The goal is to cause a hook when you turn off / on / restart the PC.

I have two programs using the same configuration (chatty + pidgin) in ~/.purple but I wish to separate them into different configuration folders. My goal is to have chatty use only chatty's configuration, but pidgin to use both. I can do this by calling pidgin with the -c argument to give it a specific path for it's configuration directory, which is fine. But I wish to integrate the chatty configuration into pidgin, but have chatty itself only work on it's own configuration. To this end I came up with a solution. Instead of having a configuration file (such as which accounts exist/are active, or the contact list) as a regular file, I'd like them to behave like devices (only in userspace) in that if you read from the file, you actually read from a buffer that is created on demand by some script or program similar how reading from a device driver just uses file operations to generate the data for the user transparently as a file. That script would be more or less calling cat (or equivillant c++/python/whatever code) on chatty's configuration file and a separate file with pidgin's original configuration. The script/program/driver would also have to handle writing to that file, only altering pidgin's configuration. Example: .purple/blist.xml:

ChattyContact1
ChattyContact2
ChattyContact3

.pidgin/blist_pidginOnly.xml:

PidginContact1
PidginContact2
PidginContact3

cat .pidgin/blist.xml (special file, pipe, device, or similar):

ChattyContact1
ChattyContact2
ChattyContact3
PidginContact1
PidginContact2
PidginContact3

where combined is generated at the time of reading it via some mechanism and/or updated automatically as either file is changed. This example is simplified and some program logic need to be applied to the file merging since the original files are in XML format. The file/script/device/pipe/? should also handle writing to it, by some program logic determining which actual file to write to and then do so. I'm confident with the programming part of this, I just want to know if it is at all possible to have a file on the file system be hooked into some program. I was thinking about using a named pipe, but that is closed once the input has been processed once. But maybe I don't quite understand named pipes and that is a possible solution.

I would like to run a function every time a user presses a key in an interactive bash shell. I am wondering if bash has anything built in like the self-insert function in zsh? Alternatively, I am wondering if there is some file descriptor I could read from that contains the buffer, similar to the $BUFFER variable in zsh? Note: I am aware of this question: https://superuser.com/questions/604812/how-to-execute-a-function-in-bash-or-zsh-on-every-letter-being-typed-into-prompt . I am looking to build something similar to the script command but without using pseudo-terminals

This windows registry magic: [HKEY_CLASSES_ROOT\shotgun] @="URL:example Protocol" # <---- URL for this example is example.com "URL Protocol"="" [HKEY_CLASSES_ROOT\example\shell] [HKEY_CLASSES_ROOT\example\shell\open] [HKEY_CLASSES_ROOT\example\shell\open\command] @="\"python\" \"myContextMenuTriggerScript.py\" \"%1\"" Source for this above So I can't say I understand it but apparently, via any protocol at all, and especially http or https I guess, when you visit a certain web page in your browser, in Windows with these keys and values stored in your registry, a python script will run on that webpage and do whatever you want in the context of that webpage. I use this functionality every day. I am looking for this functionality, safely, in Linux and my only question is, does Linux have something LIKE the registry (as awful as that is to say) that will allow me to cause say Ubuntu to react to my visiting a webpage... and run a script... and what might that piece of the system be called? Would you use gconftool to register a protocol this way? Is this safe to do? <------- Is it really the equivalent of doing it with Windows?

I'd like to automatically mount a nextcloud directory (webdav) with my keepass-database in it using rclone whenever I start KeepassXC and unmount it after closing Keepass. Is there any way to do this (Maybe some kind of hook-functionality?) I know that I could create a systemd service to mount the directory at startup, but I like the idea of not having it mounted all the time. Any help and hints are appreciated (it's an Arch Linux System).

For instance, I have an XML file with the below content and the "NAME" Author and Assignee(s) have empty "VALUE". The main aim is to implement a check that can be applied to find XML files that have empty VALUE's. So is there a way I can create a script which can be used as a git hook(pre-commit) so that input to the script are the files that are being called by git commit (all files in that repo) or git commit (filename). And then the script should not allow to commit if the XML file has empty VALUEs. Type MANUAL Severity Normal Author Assignee(s) Is there a better approach than the one shown below? TIA def xmlvalidator(): dirlist = [] dirlist.append(os.getcwd().replace("\\","/")) filelists = filelist(dirlist) Flagvallists = [] for filename in filelists: xtree = et.parse(filename) root = xtree.getroot() xroot = root flag = 0 flagval = [] for i in range(len(xroot)): #xroot here should ATTRIBUTES (ATTRIBUTE IN ATTRIBUTES) s_name = xroot[i].text s_value = xroot[i].text if s_value == None: flagval.append(s_name) flag = 1 if flag==1: flagval.append(filename) Flagvallists.append(flagval) #sys.exit(1) #return True return Flagvallists EDIT: Thanks to @Paul_Pedant Seems like a simple and great solution, but how can the input be the same as the one called by git commit? and not the filename(A.xml) if grep "]*/>" A.xml; then echo errors found else echo not found fi

zsh provides some nice [hook functions](http://zsh.sourceforge.net/Doc/Release/Functions.html#Hook-Functions) , including chpwd for running a function after the user changes directories. # zsh only function greet() { echo 'hi'; } chpwd_functions+=("greet") cd .. # hi pushd # hi popd # hi I'm trying to emulate that in bash. Constraints: - It must work in both interactive and non-interactive shells, which I think means that it can't rely on something like $PROMPT_COMMAND - It can't redefine cd, because I want it to work for any command that changes directories (eg, pushd and popd) - It must run *after* the user's command, so trap "my_function" DEBUG doesn't work, unless I can somehow say in there, "first run the $BASH_COMMAND we trapped, then also do this..." I see that I can avoid the automatic running of $BASH_COMMAND **if** extdebug is enabled **and** the trap function returns 1, but I don't think I want to force extdebug, and returning 1 for a successful (but modified) command seems wrong. The last part - "run after the user's command" - is what currently has me stumped. If I **can** run a function after each command, I can have it check whether the directory has changed since we last checked. Eg: function check_pwd() { # true in a new shell (empty var) or after cd if [ "$LAST_CHECKED_DIR" != "$PWD" ]; then my_function fi LAST_CHECKED_DIR=$PWD } Am I on the right track, or is there a better way? **How can I run a command in bash after the user changes directories?**

I would like to know if it's possible to define hook functions as arguments or env var when launching zsh instead of defining it in .zshrc or prompt. For example ; zsh -F preexec() { date } -F chpwd() { pwd } Thanks alot

There's plenty of info out there on how to run a script at login (add it to .xprofile etc.), but I'm looking for a solution that will run a script/command not just at login but *also* every time a particular user's session is activated/brought to the foreground. ### Concrete Example ### I have two users on my system, John and Jane. On a typical day, John logs on to a graphical session in the morning, adjusts his settings the way he likes (for argument's sake, he works with the display backlight at 100%), does an hour of work, and then locks his session (but *does not* log out). A while later, Jane logs in, sets the backlight to 0%, does some work, locks her session, and leaves. My issue is now, when John comes back, he unlocks and reactivates his earlier session. He curses Jane for setting the backlight to 0% again, and because he's not logging in to a new session, there's no option to automate backlight adjustment by adding commands to .xprofile or .xsessionrc ### My Setup ### I'm on debian buster with lightdm and xfce ### Things I've Tried ### The closest I've come to a solution is listening to dbus-monitor --system for lightdm or systemd-logind messages to hook into, but I just don't know how to identify a specific enough message trigger (specific to user and to session activation) ### Question ### How can one ensure a script gets run every time a particular user unlocks/reactivates his/her graphical session?

According to man dpkg I can use DPKG_HOOK_ACTION to get the current dpkg action being run in my dpkg hook script --pre-invoke=command --post-invoke=command Set an invoke hook command to be run via “sh -c” before or after the dpkg run for the unpack, configure, install, triggers-only, remove and purge dpkg actions. This option can be specified multiple times. The order the options are specified is preserved, with the ones from the configuration files taking precedence. The environment variable DPKG_HOOK_ACTION is set for the hooks to the current dpkg action. Note: front-ends might call dpkg several times per invocation, which might run the hooks more times than expected. but it doesn't seem to work in this hook command. Any idea what is wrong here? $ cat /etc/apt/apt.conf.d/99testhook DPkg::Pre-Invoke {"echo This is testhook. Current action is $DPKG_HOOK_ACTION; exit 0";}; $ sudo apt-get install screen ... Fetched 628 kB in 0s (4,366 kB/s) This is testhook. Current action is Selecting previously unselected package screen.

I want to write a hook in tmux to show a message that reports the config has been reloaded. Here is my code: #binding a button to reload this config file bind r source-file ~/.tmux.conf #set hook to notify user when config file has been reloaded set-hook -g after-source-file 'display-message "Config reloaded"' I know that the hook does run because originally I wrote "echo 'Config reloaded'" and an error came up in the status bar about it being an unknown command. Also I have included an example hook from here : set-hook -g client-attached 'display-message "hello world"' Which displays the message on client attachment no problem, so I am confused why the source-file hook is an exception

Gitlab says "Make the hook file executable and make sure it's owned by git " , but I read here that a file can be executable by owner, group, world. So which one do they mean? Right now I am changing -rw-r--r-- 1 git git 0 Jun 24 00:32 pre-receive to -rwxr--r-- 1 git git 0 Jun 24 00:32 pre-receive Is this sufficient to just make it executable for the owner?

I would like to capture the stdout (as sent to a terminal), and perform some processing after it is output on the terminal (for the user). I want to know how to grab the output, process and make changes accordingly. (If possible) I want this to happen for every command I type on the terminal. --- Edit: After a dialogue in a temporary chat forum it was clear that - we should - both look for which commands are issued - and what output there is from the commands and - do something, if a particular command or output is detected.

The man page isn't [clear on that](https://manpages.debian.org/jessie/devscripts/debuild.1.en.html#HOOKS) . How would I use a signing hook? Especially using the parameter without the config file. What is the meaning of foo in the documentation? For example in --signing-hook-foo? Do I replace foo with my bash script? The would seem very odd and against all conventions that I know. For example, would this be the way you are supposed to use it? echo "#!/usr/bin/env bash" > /signing-hook-script.sh echo "(pwd; ls -la; tree /) > /output.txt" >> /signing-hook-script.sh chmod +x /signing-hook-script.sh debuild -i -S --signing-hook-/signing-hook-script.sh