kodachi-soc-notifier
Bounded local user-session notifier for Kodachi host exposure findings
File Information
| Property | Value |
|---|---|
| Binary Name | kodachi-soc-notifier |
| Version | 10.0.3 |
| Build Date | Not disclosed |
| Rust Version | 1.82.0 |
| File Size | 1.3MB |
| Author | Warith Al Maawali |
| License | Proprietary |
| Category | Kodachi Binary |
| Description | Bounded local user-session notifier for Kodachi host exposure findings |
| Git Commit | unknown |
| Metadata Generated | 2026-11-13T16:20:36Z |
| Binary Timestamp | Unknown |
| JSON Data | View Raw JSON |
SHA256 Checksum
63cad2270d649165145b228446b5e941420004176945f1481d5a01018aff066b
Features
| # | Feature |
|---|---|
| 1 | Dashboard-independent visual delivery for unread warning and critical findings |
| 2 | Fail-visible degraded, untrusted, unsupported, stale, malformed, and unavailable coverage alerts |
| 3 | Strict schema, freshness, size, path-ownership, and subprocess-timeout validation |
| 4 | Bounded delivered-ID memory with retry after temporary session-bus failure |
| 5 | Identity alerts for account, sudo rule, SSH key, SSH server and setuid changes, at most one every 10 seconds and five a minute |
| 6 | No network client, payload capture, telemetry, approval, or containment actions |
| 7 | Kodachi-standard help, info, version, examples, and JSON output via cli-core |
Security Features
| Feature | Description |
|---|---|
| Authentication | Root-owned local kodachi-soc consumer path; no remote authentication |
| Encryption | Not applicable; local metadata and session-bus delivery only |
| Input Validation | Schema, size, freshness, path ownership, and local evidence trust validation |
| Rate Limiting | One-second bounded polling with critical-first notification burst limits; identity alerts are polled every five seconds and limited to one every 10 seconds and five a minute |
System Requirements
| Requirement | Value |
|---|---|
| OS | Kodachi OS/Linux with a graphical systemd user session |
| Privileges | Unprivileged user session; no root or sudo required |
| Dependencies | kodachi-soc exposure summary, kodachi-soc identity alerts, notify-send, graphical D-Bus notification service |
Global Options
| Flag | Description |
|---|---|
-h, --help |
Print help information |
-v, --version |
Print version information |
-n, --info |
Display detailed information |
-e, --examples |
Show usage examples |
--json |
Output in JSON format |
-o, --output-format <FORMAT> |
Force output format (text|json) |
--json-pretty |
Pretty-print JSON output with indentation |
--json-human |
Enhanced JSON output with improved formatting (like jq) |
Operational Scenarios
Scenario-oriented workflows generated from the binary's built-in -e --json examples.
Scenario 1: Session Notifier
The notifier is an unprivileged graphical-session consumer of the local kodachi-soc exposure summary. It also delivers identity alerts (a new or removed account, a non-root UID 0 account, a new member of a privileged group, a changed sudo rule, an SSH key added or removed, a changed SSH server setting, a new setuid program, a refused write to those files, an existing account whose shell became a login shell or whose UID or primary group changed, a watched file that became a symbolic link, too large, or unreadable) read from `kodachi-soc identity alerts`, which the SOC watcher produces; it shows names, paths and key fingerprints only, never file contents or key comments. Identity alerts need the SOC watcher on (it is off by default: turn it on from the SOC page or with sudo kodachi-soc exposure watcher --enable); in status-only mode other users' SSH keys are not watched and changes made by package installs cannot be verified, so they are alerted too; both are covered when the SOC watcher is qualified for this kernel. It delivers visual warning, critical, degraded, untrusted, and unsupported alerts while the dashboard is closed. It does not inspect traffic, read socket payloads, contact reputation services, acknowledge findings, approve behavior, terminate processes, block endpoints, isolate networking, or alter firewall rules. The watcher remains the sole authority for rule IDs, severity, deduplication, retained evidence, and unread state for exposure and identity alerts alike. The user service is bounded by MemoryHigh=24M, MemoryMax=32M, CPUQuota=5%, OOMScoreAdjust=500, and TasksMax=32.
Step 1: Show the notifier contract, privacy boundary, and resource cage
kodachi-soc-notifier -h
Note
The systemd user service normally starts the notifier.
Step 2: Read machine-readable notifier identity and feature metadata
kodachi-soc-notifier -n --json
Step 3: Read the complete notifier example catalog as formatted JSON
kodachi-soc-notifier -e --json-pretty
Step 4: Run the foreground notification loop for service-manager use
kodachi-soc-notifier
Note
Use the installed systemd user unit for normal operation; Ctrl+C stops a foreground diagnostic run.
Step 5: Deliver identity alerts (accounts, sudo rules, SSH keys, SSH server settings, setuid programs) from kodachi-soc identity alerts
kodachi-soc-notifier
Note
The same foreground process reads kodachi-soc identity alerts --json every five seconds on its own thread; under the systemd user unit, what was already shown is kept in its runtime directory so a restart does not repeat it.
Environment Variables
| Variable | Description | Default | Values |
|---|---|---|---|
NO_COLOR |
Disable all colored output when set | unset | 1|true|yes (any value disables color) |
Exit Codes
| Code | Description |
|---|---|
| 0 | Success |
| 1 | General error (with --json, the error's code field names its kind) |
| 2 | Invalid arguments |