pyr0ball
c356c1d4c5
Adds 141 new pattern entries via expansion script: Universal (all 25 files): - slow-boot-network-wait: detect NetworkManager-wait-online stalling boot - slow-boot-device-timeout: detect fstab entries for disconnected devices - slow-boot-long-running-job: surface slow service with systemd-analyze hint - ssh-permissions-key: catch unprotected private key file warning - flatpak-missing-runtime: detect missing Flatpak runtime with update/reinstall advice Per distro family: - apparmor-denial: added to windows-to-debian (only missing debian target) - xwayland-crash: added to all files missing it, with distro-correct install cmd (apt/pacman/dnf/zypper per target family) All 42 Rust unit tests pass.
119 lines
7.4 KiB
TOML
119 lines
7.4 KiB
TOML
[meta]
|
|
source_os = "supplement"
|
|
target_distro_family = "any"
|
|
|
|
# Supplementary patterns for users dual-booting Windows alongside any Linux distro.
|
|
# These patterns cover coexistence-specific issues that only appear because both OSes
|
|
# share the same hardware. This file is merged on top of the primary migration pattern file.
|
|
|
|
[log_paths]
|
|
|
|
# ── NTFS / Fast Startup ───────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "ntfs-volume-dirty"
|
|
sources = ["kmsg"]
|
|
match_text = "volume is dirty"
|
|
severity = "warn"
|
|
title = "Windows drive needs a check (Fast Startup)"
|
|
body = "Windows didn't shut down cleanly — it probably used Fast Startup (hibernation). Linux mounted the NTFS partition read-only to protect your data. Fix in Windows: Start -> Power -> hold Shift and click Shut Down (real shutdown, not hibernate). Then turn Fast Startup off: Control Panel -> Power Options -> 'Choose what the power buttons do' -> uncheck 'Turn on fast startup'."
|
|
|
|
[[patterns]]
|
|
id = "ntfs-force-required"
|
|
sources = ["kmsg"]
|
|
match_text = "Dirty flag is set"
|
|
severity = "warn"
|
|
title = "NTFS drive mounted read-only (dirty flag)"
|
|
body = "Windows left the NTFS filesystem marked dirty. Boot into Windows and do a full shutdown (Shift+Shut Down), or force-fix on Linux: sudo ntfsfix /dev/sdXN — replace sdXN with the partition shown in the error."
|
|
|
|
[[patterns]]
|
|
id = "ntfs-hibernation"
|
|
sources = ["kmsg"]
|
|
match_text = "Windows is hibernated"
|
|
severity = "warn"
|
|
title = "Windows is hibernated — partition locked"
|
|
body = "Linux found a Windows hibernation file (hiberfil.sys) and can't write to the NTFS partition safely. You must resume and properly shut down Windows first. To remove the hibernation file permanently: in Windows as admin, run: powercfg /h off"
|
|
|
|
# ── Clock skew ────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "rtc-time-wrong"
|
|
sources = ["journald"]
|
|
match_text = "RTC time"
|
|
severity = "info"
|
|
title = "System clock drifted after Windows boot"
|
|
body = "Windows stores the hardware clock in local time; Linux stores it in UTC. Dual-booting causes clock drift between sessions. Fix permanently in Linux: timedatectl set-local-rtc 0 (keep Linux correct and fix Windows instead). Or in Windows, add a registry key to use UTC: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation, add DWORD RealTimeIsUniversal = 1."
|
|
|
|
# ── GRUB overwritten by Windows ───────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "grub-missing-windows-update"
|
|
sources = ["journald"]
|
|
match_text = "error: no such device"
|
|
severity = "warn"
|
|
title = "GRUB may have been overwritten"
|
|
body = "Windows Update sometimes overwrites the EFI boot entry. If Linux stopped booting after a Windows update: boot from your Linux USB installer -> rescue/chroot -> reinstall GRUB: grub-install /dev/sdX && update-grub (Debian/Ubuntu) or grub-install /dev/sdX && grub-mkconfig -o /boot/grub/grub.cfg (Arch)."
|
|
|
|
# ── BitLocker ─────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "bitlocker-blocked"
|
|
sources = ["kmsg"]
|
|
match_text = "BitLocker"
|
|
severity = "info"
|
|
title = "BitLocker encrypted partition"
|
|
body = "This Windows partition is BitLocker-encrypted. Linux can mount it with dislocker: sudo apt install dislocker (Debian) or paru -S dislocker (Arch). You'll need the BitLocker recovery key from your Microsoft account."
|
|
|
|
# ── Shared NTFS partition permissions ────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "ntfs-permission-error"
|
|
sources = ["journald"]
|
|
match_text = "ntfs-3g: Failed to open"
|
|
severity = "warn"
|
|
title = "NTFS permission error"
|
|
body = "ntfs-3g can't open the Windows partition. Check your /etc/fstab mount options — add uid=1000,gid=1000,umask=022 to give your Linux user access. Make sure Windows is fully shut down first."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-network-wait"
|
|
sources = ["journald"]
|
|
match_text = "Failed to start Network Wait Online"
|
|
severity = "warn"
|
|
title = "Boot is slow: waiting for network"
|
|
body = "systemd is waiting for a full network connection before finishing boot. This is almost never needed on a desktop or laptop. Disable it: sudo systemctl disable systemd-networkd-wait-online.service NetworkManager-wait-online.service — then reboot. Unlike Windows, Linux lets you disable any boot step that isn't relevant to your setup."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-device-timeout"
|
|
sources = ["journald"]
|
|
match_text = "Timed out waiting for device"
|
|
severity = "warn"
|
|
title = "Boot is slow: a device that no longer exists"
|
|
body = "systemd is waiting for a disk, partition, or device that isn't connected. Common cause: /etc/fstab has an entry for an external drive or old partition. Check: cat /etc/fstab — look for lines pointing to drives that aren't always connected. Add the 'nofail' option to make them optional: UUID=xxx /mnt/point type defaults,nofail 0 0. Or comment the line out with #."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-long-running-job"
|
|
sources = ["journald"]
|
|
match_text = "A start job is running for"
|
|
severity = "info"
|
|
title = "A service is taking a long time to start"
|
|
body = "A background service is taking longer than expected during boot. To find what's slowing your startup: open a terminal after booting and run: systemd-analyze blame — the top entries are the biggest contributors. For a visual timeline saved to a file: systemd-analyze plot > ~/boot-profile.svg — then open the SVG in a browser."
|
|
|
|
# ── SSH / remote access ───────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "ssh-permissions-key"
|
|
sources = ["journald"]
|
|
match_text = "WARNING: UNPROTECTED PRIVATE KEY FILE"
|
|
severity = "warn"
|
|
title = "SSH key permissions are too open"
|
|
body = "Your SSH private key is readable by other users on this system — SSH refuses to use it as a security measure. Fix: chmod 600 ~/.ssh/id_rsa (replace id_rsa with the key filename shown in the error). Also lock the directory: chmod 700 ~/.ssh. This is different from Windows where file permissions are mostly advisory."
|
|
|
|
# ── Flatpak ───────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "flatpak-missing-runtime"
|
|
sources = ["journald"]
|
|
match_text = "error: runtime/org."
|
|
severity = "warn"
|
|
title = "Flatpak app is missing a runtime"
|
|
body = "A Flatpak app can't find a required runtime (a shared set of libraries). Update all runtimes first: flatpak update — if that doesn't fix it, reinstall the app: flatpak install flathub com.example.AppName. Flatpak runtimes are like Windows runtime packages (VC++ Redistributable) but for Linux apps."
|