Don't run the security scan while gaming - #4
Open
Percius04 wants to merge 3 commits into
Open
Conversation
Fixes elynch303#1 (partially -- AUR-Malware's dead upstream URL is a separate, unresolved problem left out of this PR on purpose). - SecurityWidget.qml: bbInstallProc targeted the bumblebee module root (github.com/perplexityai/bumblebee@latest), which go install rejects ('found, but does not contain package ...'). The installable binary lives at cmd/bumblebee. Verified working end-to-end after the fix. - qs-security-scan.sh + systemd/qs-security-scan.{service,timer}: the README documents this script and timer as what feeds the widget's status file, but neither was actually shipped in the repo -- so even a correctly installed scanner never produced a result. Adds the script (skips AUR-Malware cleanly when it's not installed, runs bumblebee scan and summarizes package/finding counts) and the unit files, plus wires an opt-in step into install.sh mirroring the existing bun-check flow. Tested on a real machine: bumblebee installs and scans correctly, qs-security-scan.timer runs on the 6h schedule and writes a status file the widget reads and displays.
Atomic-Arch/AUR-Malware (what the install button cloned and the README pointed at) has been deleted -- clone always failed, surfaced as the generic "maybe git isn't in PATH" error. The fallback destination, /local/applications/AUR-Malware, also isn't writable by a normal user (no sudo in this flow), so even a working URL would have failed there. nightdevil00/AUR-Malware -- already linked in this repo's own GitHub "About" section as the intended source, just never wired into the README or the install button -- is a maintained fork shipping the same check-atomic-arch_new.sh entry point. Repointed the install button, default path/env-var fallback, and README to it, using ~/.local/share/AUR-Malware instead of the root-owned path. Also fixes the AUR-Malware branch of qs-security-scan.sh, which never surfaced findings: the script's exit code is always 0 regardless of result, and the previous "last output line" heuristic picked up a disclaimer fragment instead of a verdict. Switched to --json and parse the trailing JSON object (verdict + pass/warn/fail counts) directly. Fixes elynch303#1.
qs-security-scan.timer fires every 6h regardless of what's running -- including mid-session, competing for CPU/IO with whatever's using them. - ExecCondition skips a scheduled run (without counting it as a failure) while GameMode reports an active client. - Nice=19 + IOSchedulingClass=idle cover a game launching after a scan is already in flight, so it yields instead of competing. Both are no-ops if gamemoded isn't installed.
Percius04
added a commit
to Percius04/security-scan
that referenced
this pull request
Aug 1, 2026
…md ExecCondition)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #2 (adds
systemd/qs-security-scan.service, which this modifies).qs-security-scan.timer fires every 6h regardless of what's running -- including mid-session, competing for CPU/IO with whatever's using them. The scan got noticeably heavier once AUR-Malware's payload-hash sweep is in the mix (hashes every candidate file across several package-manager caches), so this got more noticeable.
ExecConditionskips a scheduled run (without counting it as a failure) while GameMode reports an active client.Nice=19+IOSchedulingClass=idlecover a game launching after a scan is already in flight, so it yields instead of competing.Both are no-ops if
gamemodedisn't installed. Tested on a machine with GameMode installed: the scan is skipped while a game session is active, and resumes on the next timer tick once it ends.