sssnake/CellGuard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add supervisor to keep enforcement + detection daemons alive

Browse Source 
cgwatch.sh respawns ratlock/cgdetect within ~30s if either dies (crash,
OOM, accidental kill), so the guard self-heals instead of staying down
until the next reboot. service.sh now launches the supervisor after the
RIL-up wait rather than starting the two daemons directly.
This commit is contained in:
sssnake
2026-07-12 11:34:49 -07:00
parent a5700eddce
commit 11d2a3d784
2 changed files with 40 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
cgwatch.sh Normal file
View File

@@ -0,0 +1,28 @@
#!/system/bin/sh
# CellGuard supervisor — keeps the enforcement (ratlock) and detection
# (cgdetect) daemons alive and respawns either one if it dies, so a crash,
# a one-off OOM, or an accidental kill self-heals within ~30s instead of
# leaving the guard down until the next reboot.
#
# Started once by service.sh at boot. Respawned daemons are launched with
# setsid so they reparent to init (ppid=1) and survive this supervisor and
# any adb/su session. pgrep uses short script-name patterns — this script's
# own cmdline is "sh .../cgwatch.sh", so it never self-matches ratlock/cgdetect.
MODDIR=${0%/*}
CG=/data/adb/cellguard
mkdir -p "$CG"
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$CG/cgwatch.log"; }
log "cgwatch start (pid $$)"
while true; do
if ! pgrep -f ratlock.sh >/dev/null 2>&1; then
setsid sh "$MODDIR/ratlock.sh" 5 </dev/null >/dev/null 2>&1 &
log "respawned ratlock"
fi
if ! pgrep -f cgdetect.sh >/dev/null 2>&1; then
setsid sh "$MODDIR/cgdetect.sh" 4 </dev/null >/dev/null 2>&1 &
log "respawned cgdetect"
fi
sleep 30
done

30
service.sh
View File

@@ -32,26 +32,20 @@ else
log "cgcap.ko missing at $KMOD — build it first" log "cgcap.ko missing at $KMOD — build it first"
fi fi
# --- 2. enforcement: hold every active SIM to LTE + 5G(NR) only --- # --- 2. wait briefly for RIL/subscriptions to come up after boot ---
# ratlock runs its own watchdog loop; launch once, in background. # (enforcement needs the telephony API to be live before it can set RAT).
if ! pgrep -f "$MODDIR/ratlock.sh" >/dev/null 2>&1; then for i in $(seq 1 30); do
# wait briefly for RIL/subscriptions to come up after boot [ -n "$(cmd phone get-allowed-network-types-for-users -s 0 2>/dev/null)$(cmd phone get-allowed-network-types-for-users -s 1 2>/dev/null)" ] && break
for i in $(seq 1 30); do sleep 1
[ -n "$(cmd phone get-allowed-network-types-for-users -s 0 2>/dev/null)$(cmd phone get-allowed-network-types-for-users -s 1 2>/dev/null)" ] && break done
sleep 1
done
nohup sh "$MODDIR/ratlock.sh" 5 >/dev/null 2>&1 &
log "ratlock started (LTE+NR/5G enforcement watchdog)"
else
log "ratlock already running"
fi
# --- 3. detection: always-on IMSI-catcher detector (independent of WebUI) --- # --- 3. supervisor: starts + keeps alive both enforcement (ratlock) and
if ! pgrep -f "$MODDIR/cgdetect.sh" >/dev/null 2>&1; then # detection (cgdetect) daemons, respawning either if it dies. ---
nohup sh "$MODDIR/cgdetect.sh" 4 >/dev/null 2>&1 & if ! pgrep -f cgwatch.sh >/dev/null 2>&1; then
log "cgdetect started (always-on IMSI-catcher detector)" setsid sh "$MODDIR/cgwatch.sh" </dev/null >/dev/null 2>&1 &
log "cgwatch supervisor started (respawns ratlock + cgdetect)"
else else
log "cgdetect already running" log "cgwatch already running"
fi fi
log "CellGuard service done" log "CellGuard service done"