Notes on technical choices

Blocking

Blocking is done by putting domains into /etc/hosts, pointed at localhost, and the file is made immutable with chattr +i. A small server on 127.0.0.1 answers those requests with a blocked page and logs the hit. The domains are fetched from public blocklists. Domains which have web based proxies are also blocked. A Firefox/Chrome extension, force-installed through the browsers’ enterprise policies, catches keywords in URLs and page content. Programs on a list are killed during their windows. Repeated violations run a command of your choice, usually a screen lock you can’t dismiss until it times out.

Taking away sudo

If glocker is uninstalled, all protections are lifted. This is prevented by allowing only root to uninstall it and then removing root access during specified windows. During the hours you choose, your sudo line is the full one; outside them it’s a short list of harmless commands. glocker writes that line to its own file, /etc/sudoers.d/glocker, validated with visudo first, and swaps it on schedule.

That only works if it’s your only sudo, and every distro hands out sudo differently. Debian, Ubuntu and Fedora use a group (sudo or wheel); Arch’s installer and Omarchy write a per-user file in sudoers.d; Ubuntu cloud images add a NOPASSWD file of their own. So install has an explicit plan per distro: it removes you from the admin group or moves your file aside, records exactly what it changed, and uninstall puts it back. On a distro without a plan, the sudo window is simply off. An earlier version edited /etc/sudoers directly and broke on Ubuntu’s new sudo-rs, which rejects a file without a trailing newline.

glocker -check lists the routes that still get you root: a root password for su, SSH root login, other users with sudo, auto-login. I keep recovery mode open on purpose, as the break-glass.

Making uninstall slow

Now, during the sudo window, it will be possible to uninstall glocker but that can be made annoying enough to prevent you from doing it unless you really need to. glocker -uninstall asks for a reason and then a typing test: a sentence is revealed one character per second, and you type each character as it appears. A wrong key or falling behind starts it over. If you uninstalled recently, the sentence gets longer. It sounds silly, but a minute of typing “I am removing my own guardrails” is usually enough to change your mind.

Watchdog

A small watchdog, glockdoc, pings the daemon every 30 minutes and logs the result, and it survives an uninstall, so a silent teardown still shows up as a gap. With the hosted dashboard, those heartbeats go to a server, and if none arrive for about an hour it emails your accountability partner. This is available on the hosted plan since it requires an email setup.

What the server can see

Synced records are encrypted on the machine before upload. A random master key encrypts window titles, URLs, keywords, app names and reasons per field with AES-GCM; the key is wrapped under your passphrase (PBKDF2-SHA256, 600,000 iterations) and decrypted in the browser. Record IDs are an HMAC under the same key, so they can’t be used to guess contents.

Some metadata stays readable, deliberately: timestamps, idle time, window counts, the type of a violation or lifecycle event, and whether a heartbeat arrived. The partner emails need that, and they contain counts and liveness, never what you visited. PBKDF2 isn’t memory-hard, so the passphrase has to be strong; the setup page enforces that. I’m not a cryptographer and this hasn’t been independently audited.

Known problems and future plans

1. The hosts file only stops programs that use the system resolver, so DNS-over-HTTPS and a SOCKS proxy with remote DNS get around it.
2. The Chrome policy turns DoH off; Firefox’s doesn’t yet, and a browser glocker doesn’t manage has no policy at all.

These are written up in docs/bypasses.md. The real fix for the first two, a local resolver with firewall rules, is the next big piece.

The goal was never a perfect lock. It’s to put enough friction and enough record between me and the habit that I stop before I start.

Glocker is open source (AGPL) and runs on Debian, Ubuntu, Fedora, Omarchy and Arch. The guide covers setup and the thinking behind it.