Chapter 28 — Systems, endpoints and hardware security: implementation I
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 Implementation"]
N2["28.2 Test session"]
N3["Lab — Lab — session changes and restore"]
N4["28.3 Reading the result"]
N5["28.4 Assumption checked"]
N6["28.5 Edge cases"]
N7["Test plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 Implementation"]
N2["28.2 Test session"]
N3["Lab — Lab — session changes and restore"]
N4["28.3 Reading the result"]
N5["28.4 Assumption checked"]
N6["28.5 Edge cases"]
N7["Test plan"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 Implementation]
|
v
[28.2 Test session]
|
v
[Lab — Lab — session changes and restore]
|
v
[28.3 Reading the result]
|
v
[28.4 Assumption checked]
|
v
[28.5 Edge cases]
|
v
[Test plan]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) implement the restore mechanism on lab PCs; (2) detect session changes; (3) verify that restore reverts them.
28.1 Implementation
Mateo configures three lab PCs with the golden image and restore script.
The three lab PCs are the same models used in the branches, including one older unit from Eastgate. They sit on a lab network that mirrors a branch segment, with a test management server. Using real models matters because firmware settings and restore times differ between them. Nothing on the lab network can reach branch PCs, so a mistake during implementation affects only the lab. Marta approved the lab layout.
28.2 Test session
A synthetic session changes the browser home page and saves a CV in the patron area.
The session mimics what Fernhill's records show patrons actually do: change a setting while browsing and save a document. The CV is synthetic, created for the test. Mateo runs the session through the normal patron login, not an administrative account, so the changes land where a real patron's would. The restore then runs at the scheduled time as it would in a branch. Nothing else is changed.
Lab — Lab — session changes and restore
"""Detect files changed during a patron session and confirm the nightly restore reverts them (synthetic)."""
import hashlib
def h(b): return hashlib.sha256(b).hexdigest()
golden = {"/sys/policy.cfg": h(b"policy v3"), "/apps/browser.cfg": h(b"home=library"), "/home/patron/.keep": h(b"")}
after_session = dict(golden, **{"/apps/browser.cfg": h(b"home=other"), "/home/patron/cv.docx": h(b"cv")})
after_restore = dict(golden)
changed = [p for p in after_session if golden.get(p) != after_session[p]]
print(f"changed or added during session: {len(changed)} -> {', '.join(changed)}")
left = [p for p in after_restore if golden.get(p) != after_restore[p]] + [p for p in golden if p not in after_restore]
print(f"differences after restore: {len(left)}")
Run with python3 lab_restore.py. Verified output:
changed or added during session: 2 -> /apps/browser.cfg, /home/patron/cv.docx
differences after restore: 0
28.3 Reading the result
Two items changed or were added during the session: the browser configuration and the CV. After restore, there are zero differences from the golden manifest.
The first line confirms the session made the expected changes, which shows the test was valid: a restore cannot be judged on a session that changed nothing. The second line shows the restore returned every item to the golden state. Mateo keeps both lines in the test record, together with the image version and the date of the run.
28.4 Assumption checked
This confirms the chapter 6 assumption of full removal for the patron area.
The exposure model assumed that each reset removes everything a patron left behind. This lab is the first direct evidence for that assumption in the patron area, and the worked example shows why the evidence was needed: a folder outside the original scope kept files until the scope was fixed. Mateo updates the model's notes to say the assumption is now tested, and on which evidence. Marta reviewed the change.
28.5 Edge cases
Tests also cover a session ended by power loss and a PC rebooted mid-restore; both restore correctly at next start.
Power loss during a session leaves the patron area in whatever state it was in; the next restore clears it as usual. A reboot partway through a restore is the harder case, since the patron area may be half replaced. Mateo's restore marks its progress, so on the next start it begins again from the protected copy and completes before any session opens. Both cases are tested on each lab PC model.
Test plan
The implementation test plan lists each scenario: normal session, power loss mid-session, reboot mid-restore, files in unusual locations and a full disk. Each has expected results. Running them on three lab PCs takes two days and finds the temp folder issue, which would otherwise have left patron files behind in production.
Tests are repeated after every change to the restore script.
Performance check
Restore takes about five minutes on lab PCs, well within the window.
Recording results
Each test result is stored with the image version, PC, date and tester. The temp folder fix is recorded as a change with its reason.
Next
Measurement in chapter 29 extends tests to branch PCs during a pilot week.
Lessons
Testing unusual locations matters because patrons save files wherever software suggests.
Worked example
A test reveals that files saved in a temporary folder outside the patron area survived restore. Mateo adds that folder to the restore scope and re-tests.
Synthetic case. Synthetic.
Errors and limits
Restore scope must include every location patrons can write.
Exercises
- EX082 — Lab changes. What changed during the test session? Rubric: 3 = browser config, CV added; 2 = partial; 1 = vague; 0 = none.
- EX083 — Post-restore. How many differences remained after restore? Rubric: 3 = 0; 2 = partial; 1 = vague; 0 = none.
- EX084 — Temp folder. What did the temp folder test reveal? Rubric: 3 = files survived outside scope; 2 = partial; 1 = vague; 0 = none.
Synthesis
Test restore against real session behaviour and fix scope gaps.
Continue studying — chapter 28 of 50
← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →