WorkWarden

WorkWarden is a Fedora GNOME-focused self-control service for separating a personal Linux account from a restricted work account.

The project installs exactly one custom systemd service:

workwarden.service

The runtime is written in C++20 and does not require Python. One binary handles the daemon, PAM quota checks, configuration reads, time tracking, logging, application restrictions, and network policy orchestration.

Status: early Fedora-only release. Test on a non-critical machine before wider use.

What it does

Default configuration assumes:

• personal account: amir
• work account: amir-work

Features:

• blocks selected executables for amir-work, including terminal execution
• prevents amir-work from using su to switch to root or amir
• removes amir-work from wheel; sudo remains an explicit allow-list you control
• can block pkexec and run0 for amir-work
• redirects normal DNS from amir-work to a filtered local resolver
• blocks both IPv4 and IPv6 DNS answers for configured domains
• blocks DNS-over-TLS on port 853 for amir-work
• leaves amir network access unrestricted
• limits amir to a daily quota and a per-session quota
• warns before the quota expires and can power off or terminate the session
• blocks new GDM/TTY login to amir after the daily quota is exhausted
• keeps amir-work login available after the personal quota is exhausted
• writes structured JSONL events to /var/log/workwarden/events.log
• retains raw DNS and sudo logs in the same log directory

Fedora GNOME only

The current release intentionally targets Fedora GNOME and relies on Fedora's systemd, PAM, auditd, SELinux policy, nftables, systemd-resolved layout, and dnsmasq.

Runtime architecture

                  workwarden.service
                          │
              C++20 workwarden binary
                          │
       ┌──────────────────┼───────────────────┐
       │                  │                   │
    App ACLs          DNS child           Time quota
       │              dnsmasq                 │
   amir-work              │                  amir
       │               nftables               │
       │            UID DNS redirect           │
       └──────────── event logger ──────────────┘
                          │
                    PAM pam-check

The installed executable is:

/usr/libexec/workwarden/workwarden

Systemd runs:

/usr/libexec/workwarden/workwarden daemon

PAM calls the same binary:

/usr/libexec/workwarden/workwarden pam-check

Build

sudo dnf install gcc-c++ cmake make
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel

Or:

make build

Install on an existing legacy WorkGuard setup

Keep a root-capable terminal/TTY available during the first migration. The installer changes PAM and DNS/NSS configuration.

Review the config first:

nano config/workwarden.toml

Then:

sudo ./scripts/install.sh

The installer builds the C++ binary and removes the old custom units:

workguard-apps.service
workguard-dns.service
workguard-network.service
workguard-time.service
amir-workguard.service

It deliberately preserves your existing /etc/sudoers.d/amir-work allow-list.

Configuration

Installed configuration:

/etc/workwarden/config.toml

Example:

[users]
personal = "amir"
work = "amir-work"
su_admin_group = "workwarden-su"

[apps]
blocked = [
  "/usr/bin/Telegram",
  "/usr/bin/pkexec",
  "/usr/bin/run0",
]

[network]
enabled = true
dns_port = 53053
upstream_dns = ["1.1.1.1", "8.8.8.8"]
blocked_domains = ["instagram.com", "reddit.com"]

[time]
enabled = true
daily_limit_seconds = 7200
session_limit_seconds = 1800
warning_before_seconds = 300
action = "poweroff"

After changing app, network, or time configuration:

sudo systemctl restart workwarden.service

Editing the website block list

Edit blocked_domains:

sudo nano /etc/workwarden/config.toml
sudo systemctl restart workwarden.service

Editing sudo access

WorkWarden intentionally does not overwrite an existing sudo allow-list:

sudo visudo -f /etc/sudoers.d/amir-work
sudo visudo -cf /etc/sudoers.d/amir-work

Logs

/var/log/workwarden/events.log
/var/log/workwarden/dns.log
/var/log/workwarden/sudo.log

events.log is JSON Lines and is rotated by the C++ daemon.

Example:

{"time":"2026-08-11T15:30:00+01:00","level":"INFO","event":"DOMAIN_BLOCKED","message":"Blocked DNS query","user":"amir-work","domain":"instagram.com"}

Follow events:

sudo tail -f /var/log/workwarden/events.log

Security model

This is a self-control boundary, not a hostile-user security sandbox. The personal/root administrator can always alter the machine. The restricted work account is intentionally denied obvious privilege-switching paths and receives only the sudo commands you explicitly allow.

DNS filtering covers normal DNS and blocks DNS-over-TLS (853). DNS-over-HTTPS, VPNs, proxies, manually supplied IPs, and other tunneling methods are not comprehensively blocked in this release.

Test

make lint
sudo ./scripts/test.sh

See docs/TESTING.md for the manual account tests.

Uninstall

sudo ./scripts/uninstall.sh

The uninstaller restores the PAM/NSS/resolver files captured by the installer and preserves user-managed sudo policy plus state/log files for inspection.

License

MIT.