Linux core operations pack

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install linux-core --hash sha256:f4f5f29abc2aa8ccef433224da60d01159ba1434d6749172ef3795583d794bcf

Setup

Operates on the local runner host — no credentials needed.

sudo install -d -m 0755 /etc/systemd/system/emisar.service.d
printf '%s\n' '[Service]' 'User=root' 'Group=root' | sudo tee /etc/systemd/system/emisar.service.d/10-linux-core-host-access.conf >/dev/null
sudo systemctl daemon-reload
sudo systemctl restart emisar

test "$(systemctl show emisar --property=User --value)" = root

sudo usermod -aG adm,systemd-journal emisar
sudo systemctl restart emisar

id -nG emisar | tr ' ' '\n' | grep -Fx adm
id -nG emisar | tr ' ' '\n' | grep -Fx systemd-journal
sudo -u emisar journalctl --no-pager -n 1 >/dev/null

sudo emisar pack verify linux-core

Install and configure a pack walks through the whole sequence on a host.

• linux.arp_neighbors exec low Low — read-only or trivially reversible

  ARP / IPv6 neighbor table

  `ip neigh show` — every known L2 neighbor with state (REACHABLE, STALE, FAILED). Useful for diagnosing intermittent L2 reachability problems. Read-only.

  View source on GitHub
• linux.cpu_info exec low Low — read-only or trivially reversible

  CPU topology and features

  Show CPU topology (`lscpu`) — sockets, cores per socket, threads per core, architecture, microarchitecture, MHz, cache sizes, vulnerabilities (Spectre/Meltdown mitigation state). Use to confirm a host's CPU matches what the workload assumes. Read-only.

  View source on GitHub
• linux.cron_recent exec high High — service-affecting

  Recent cron job execution log

  Show last N journalctl entries matching CRON. Lets operators see "did the backup job fire last night?" without grepping syslog. Read-only. CRON log lines include the executed command lines (`CMD (…)`), which routinely carry inline credentials — the same exposure as `linux.crontab_all`; the runner's redaction is a pattern-bound backstop, not a guarantee.

  View source on GitHub
• linux.crontab_all exec high High — service-affecting

  All user crontabs + system cron dirs

  Dump every per-user crontab AND the system cron dirs (/etc/crontab, /etc/cron.d/, /etc/cron.{hourly,daily,weekly,monthly}/). Use to answer "what's scheduled on this host?" Read-only. Cron command lines routinely carry inline credentials (a `curl` bearer token, a `mysql -p<pw>`), so this can surface secrets. The runner's redaction is a fail-closed backstop, not a guarantee — it is pattern-bound and can miss a bespoke secret whose name and value match no rule.

  View source on GitHub
• linux.disk_smart exec low Low — read-only or trivially reversible

  SMART health for one disk

  Run `smartctl -H -A` against a block device. Returns the overall PASS/FAIL plus the attribute table (reallocated sectors, pending, uncorrectable, temperature). Read-only on the disk; needs the `smartmontools` package and CAP_SYS_RAWIO (root) to access device registers. For a disk behind a RAID controller (Dell PERC, HP SmartArray), pass `device_type` (e.g. `megaraid,0`) — the bare block device isn't reachable through the controller without it.

  View source on GitHub
• linux.disk_usage exec low Low — read-only or trivially reversible

  Filesystem disk usage

  Report filesystem usage for the supplied paths using df. Read-only. Use this to assess disk pressure before recommending cleanup, repair, compaction tuning, or adding disk. If a filesystem is >85% full, surface it but do not silently delete or truncate data — that's a separate, approval-gated action.

  View source on GitHub
• linux.failed_logins exec medium Medium — changes state, easily reversible

  Recent failed login attempts

  List recent failed authentication attempts from the systemd journal — sshd's "Failed password" / "Invalid user" plus pam_unix "authentication failure" from su/sudo/login. High-signal for "is this host being brute-forced?" Read-only, but flagged medium-risk: the source IPs and usernames are sensitive PII. A healthy host with no failed auth returns nothing (the journal query exits 1 on no match, which is treated as success).

  View source on GitHub
• linux.grep_log exec medium Medium — changes state, easily reversible

  Grep a log file

  Grep an extended regex (POSIX -E) against a log file under /var/log. Read-only. Returns matching lines with line numbers (-n) up to max_lines. Use to find recent occurrences of a specific identifier (request ID, user ID, IP) or to spot error patterns without dumping the whole file. Output is run through the runner's redactor before it leaves the host. On journald-only hosts (no rsyslog) the system log isn't a file under /var/log — use linux.journalctl for syslog/messages; this reads on-disk files (app, nginx, …).

  View source on GitHub
• linux.hardware_summary exec low Low — read-only or trivially reversible

  Hardware + BIOS summary via dmidecode

  Show hardware identity (`dmidecode` system + bios + chassis sections) — vendor, model, serial, BIOS version, manufacturing date. Required root (read-only on SMBIOS). Useful when correlating hardware-class to OS-class incidents. dmidecode reads SMBIOS — absent on containers and many cloud VMs, where this fails command-not-found; expect it on bare metal or VMs with SMBIOS passthrough.

  View source on GitHub
• linux.inode_usage exec low Low — read-only or trivially reversible

  Inode usage per filesystem

  Show inode usage per filesystem (`df -i`). A "disk full" report that doesn't match `df -h` is almost always inode exhaustion — this surfaces it directly. Read-only.

  View source on GitHub
• linux.journalctl exec medium Medium — changes state, easily reversible

  Recent systemd journal entries

  Read recent systemd journal entries for a named unit, filtered by priority and a time window. Use to triage service errors. Logs may reveal sensitive identifiers, IPs, hostnames, or PII; treat output as confidential. Do not echo verbatim to end users without consideration.

  View source on GitHub
• linux.journalctl_grep script medium Medium — changes state, easily reversible

  Grep recent systemd journal entries

  Read a bounded recent slice for one unit, then return entries matching a POSIX extended regular expression. Filtering uses grep -E instead of journalctl --grep, so it works when journalctl was built without PCRE2. Use when you already know the rough request ID, host, IP, or error text. Only the most recent `entry_limit` entries in the window are read, and stderr says so when that limit was hit — a no-match is a successful empty result, conclusive only for the slice that was searched. An invalid expression or unreadable journal is a failure. Output is redacted before leaving the host.

  View source on GitHub
• linux.kernel_modules exec low Low — read-only or trivially reversible

  Loaded kernel modules sorted by size

  List loaded kernel modules (`lsmod`), sorted by size, top 30. Useful to spot unexpected modules loaded on a production host (rootkits, debug tooling, vendor drivers). Read-only.

  View source on GitHub
• linux.last_logins exec medium Medium — changes state, easily reversible

  Recent successful logins

  Show the last N successful logins via `last`. Depending on the distribution, `last` reads the legacy wtmp file or the wtmpdb login-history database. Shows user, terminal, source IP, and duration. Read-only.

  View source on GitHub
• linux.lvm_status exec low Low — read-only or trivially reversible

  LVM volume / group / PV summary

  Run `lvs && vgs && pvs` for a one-shot LVM topology snapshot. Logical volumes, volume groups, physical volumes — sizes, free space, attributes. Read-only. Needs LVM tools installed.

  View source on GitHub
• linux.mdadm_status exec low Low — read-only or trivially reversible

  mdadm RAID array status

  Read /proc/mdstat plus `mdadm --detail` for every active array. Surfaces array state, devices, sync progress, faults. Read-only. Returns "no arrays" cleanly when there's no mdadm RAID configured.

  View source on GitHub
• linux.memory exec low Low — read-only or trivially reversible

  System memory snapshot

  Report memory and swap usage via free -m. Read-only, single sample. Memory state fluctuates between consecutive calls; take two samples a few seconds apart before drawing conclusions about pressure.

  View source on GitHub
• linux.memory_detailed exec low Low — read-only or trivially reversible

  Full /proc/meminfo

  Dump full /proc/meminfo. More detail than the `linux.memory` action — surfaces hugepages, slab, dirty/writeback, page tables, KSM, cgroup memcg. Read-only.

  View source on GitHub
• linux.mount_status exec low Low — read-only or trivially reversible

  Mounted filesystems

  List every mounted filesystem with type, source device, mountpoint, and mount options. Read-only. Use to confirm a service has the right disk attached or to find a stuck/duplicate mount.

  View source on GitHub
• linux.network_interfaces exec low Low — read-only or trivially reversible

  Network interfaces

  `ip -j addr show` JSON. Returns every interface with its addresses, state, MAC, MTU. Use to confirm an interface is up with the right IP. Read-only.

  View source on GitHub
• linux.network_routes exec low Low — read-only or trivially reversible

  Routing table + policy rules

  `ip route show && ip rule show && ip -6 route show`. Use to debug "why does traffic go via X instead of Y?" — surfaces every route and policy-based routing rule. Read-only.

  View source on GitHub
• linux.os_release exec low Low — read-only or trivially reversible

  Distro + kernel identity

  Return /etc/os-release plus `uname -a`. Identifies the distribution, version, codename, and kernel. Use as a first sanity check before recommending distro-specific commands. Read-only.

  View source on GitHub
• linux.reboot_host exec critical Critical — data loss or irreversible

  Schedule a host reboot

  Schedule a reboot via `shutdown -r +1` — one-minute warning to give in-flight connections a chance to drain. Sends a wall message with the operator-supplied reason. Cannot be undone except by `shutdown -c` BEFORE the minute elapses; once the kernel begins shutdown the host is going down regardless.

  View source on GitHub
• linux.sudoers_dump exec medium Medium — changes state, easily reversible

  sudoers configuration audit

  Dump /etc/sudoers and the index of /etc/sudoers.d/. Use for an audit pass — "who can sudo to what?". Output is the host's privilege-escalation policy — security-sensitive recon, but sudoers stores rules, never credentials. Read-only.

  View source on GitHub
• linux.systemctl_disable exec high High — service-affecting

  Disable a systemd unit at boot

  `systemctl disable <unit>`. Removes the boot symlinks. Does NOT stop the unit now — pair with `linux.systemctl_stop` for that. Persistent change across reboots.

  View source on GitHub
• linux.systemctl_enable exec high High — service-affecting

  Enable a systemd unit at boot

  `systemctl enable <unit>`. Creates the symlinks so the unit starts at boot. Does NOT start it now — pair with `linux.systemctl_start` for that. Persistent change across reboots.

  View source on GitHub
• linux.systemctl_reload exec high High — service-affecting

  Reload a systemd unit's config

  `systemctl reload <unit>`. The unit re-reads its config without restarting (works only for units declaring an ExecReload). Use after editing nginx.conf / postgresql.conf / etc. The reload is graceful by definition — no requests dropped.

  View source on GitHub
• linux.systemctl_restart exec high High — service-affecting

  Restart a systemd unit

  Restart a named systemd unit. Clients will see an outage of seconds-to-minutes depending on the unit. Treat as a last-resort action: prefer diagnosis (logs, status, disk, memory) first. Never restart a database under load without confirming there is no in-flight repair, compaction, or similar background operation. WHICH units this runner may restart is an operator policy decision (high-risk → require_approval by default), not a fixed list; the unit is bounded to a valid systemd unit name so it can't carry shell metacharacters.

  View source on GitHub
• linux.systemctl_start exec high High — service-affecting

  Start a systemd unit

  `systemctl start <unit>`. Brings a unit up and waits for the start job to finish, so a successful run means the unit reached its started state — a failed start fails the run rather than reporting a queued job.

  View source on GitHub
• linux.systemctl_status exec medium Medium — changes state, easily reversible

  Systemd unit status

  Show a named systemd unit's runtime state and processes plus up to 10 recent journal lines. Those lines can carry application, request, or personal data no redaction list can enumerate. Use to confirm whether a service is active before recommending diagnostic or remediation actions.

  View source on GitHub
• linux.systemctl_stop exec high High — service-affecting

  Stop a systemd unit

  `systemctl stop <unit>`. Brings a unit down. Sends SIGTERM, waits for TimeoutStopSec, then SIGKILL. In-flight requests on the service are dropped unless the unit handles graceful drain.

  View source on GitHub
• linux.tail_log exec medium Medium — changes state, easily reversible

  Tail a log file

  Read the last N lines of a log file under /var/log. Read-only. Use to glance at the most recent activity for a service when triaging an alert, before deciding whether to grep deeper or pull more context. Output is run through the runner's redactor before it leaves the host. On journald-only hosts (no rsyslog) the system log isn't a file under /var/log — use linux.journalctl for syslog/messages; this reads on-disk files (app, nginx, …).

  View source on GitHub
• linux.uptime exec low Low — read-only or trivially reversible

  System uptime and load average

  Report system uptime and 1/5/15-minute load averages. Load averages are dimensionless and machine-dependent; compare against CPU count before interpreting them as "high".

  View source on GitHub
• linux.who_now exec low Low — read-only or trivially reversible

  Currently logged-in users

  List logged-in sessions (`who` + `w`) — usernames, terminals, login times, source IPs, and what each session is currently running. Use to confirm whether a human is on the box during an incident. Read-only.

  View source on GitHub