Linux Master

Audit a Debian-based Linux system and fix only what you choose

Python 3
GTK 4
libadwaita
PyGObject
systemd
pkexec
unittest

A desktop application, installed as sysaudit, that audits a Debian-derived Linux system, shows what it found together with the evidence behind it, and lets you hand-pick which remediations to apply.

Analysis is strictly read-only. Nothing on the system changes unless you tick a fix and apply it — and nothing is ever preselected.

On the machine it was written for it found, among other things, a service that had restarted 524 times looking for a binary that no longer existed, and a system Python pinned to a version the distro’s own extensions could not load.

What it does

59 checks across 11 categories

Overview and updates: distro support horizon, security updates, held packages, repo health and end-of-life suites, flatpak, firmware, pending reboot
Storage and caches: usage and inodes per mount, obsolete kernels, orphaned packages, Docker, journal size, apt, npm, pip, cargo and Go caches, core dumps
Memory and services: zram versus disk swap, swappiness, pressure stalls, OOM history, failed units, crash loops, timers and boot time
Logs and hardware: ranked, deduplicated journal errors, kernel taint decoding, temperatures against real thresholds, SMART, NVMe, battery health, throttling
Security and performance: firewall, listening ports, SSH exposure, NOPASSWD sudo, CPU mitigations, I/O scheduler, governor, TRIM and mount options

Choosing fixes

Every fix carries a risk tier: SAFE is reversible with no data loss; REVIEW changes behaviour and comes with a rationale and an undo note; MANUAL is advice only
Preview script shows the exact text that will run — the same renderer produces both
User-level actions run without a prompt; privileged ones go to pkexec as one batch, so you authenticate once
Each action runs in its own errexit subshell, so one failure is reported rather than silently aborting the rest

How safety is enforced

Advisory findings cannot execute: a MANUAL fix that carries a command raises at construction, including when loaded from a tampered JSON scan
Every command a check runs is vetted with its arguments — apt-get -s dist-upgrade is allowed, apt-get dist-upgrade is not
No shell during analysis: argv lists, mandatory timeouts and process-group kill
Destructive fixes re-verify their own preconditions — the kernel purge aborts if the running kernel is in the removal set, even if the script is run next week
The application refuses to run as root

Reports and history

Export a self-contained HTML report — no scripts, fonts or network requests — that lists skipped checks too, so it is honest about its own coverage
Every scan is kept as JSON, which drives the “3 resolved, 1 new” summary
A terminal mode that exits non-zero on anything critical, for cron or CI
Reports, scans and apply logs are written mode 0600, since they hold hostnames and log excerpts

Download

Source archive

Linux

Pure Python, nothing to build. Includes the installer and the test suite.

Download

Requirements

A Debian-derived Linux distribution — built on Pop!_OS 22.04
python3-gi, gir1.2-gtk-4.0 and gir1.2-adw-1 — nothing from PyPI
polkit (pkexec) for applying privileged fixes; scanning needs no root
The terminal, JSON and HTML report modes need no GTK

Installing

This user

tar -xzf linux-master-source.tar.gz
cd linux_master
./install.sh

Copies the application to ~/.local/lib/sysaudit, puts sysaudit on PATH and registers a menu entry and icon. No root needed.

Everyone

sudo ./install.sh --system

The same layout under /usr/local. ./install.sh --uninstall removes it and leaves scan history alone.

Without installing

./bin/sysaudit --text     # terminal report
./bin/sysaudit --report   # HTML report
./bin/sysaudit --demo     # GUI on sample data

--text exits non-zero when anything critical was found.

Source code

The source is not hosted publicly. The archive above is the complete project; if you have questions about the code, get in touch.