FAQ

Security-specific questions are in the threat model FAQ.

What platforms does it run on?

Linux only — Ghost Shell uses /proc and SO_PEERCRED. Packages target amd64; see installation. Building from source needs Go 1.25.

How is this different from script, asciinema, or bash history?

• ~/.bash_history is user-writable, drops pipes, and never records output.
• script(1) records output but writes plaintext anyone can read.
• asciinema is built for sharing demos, not for audit.

Ghost Shell records everything (input timing and full output), encrypts it at rest, and stores it where only root can read it — with replay, search, and live tail on top. See the introduction.

Does it record SSH sessions?

Yes. Interactive SSH logins are recorded by the auto-record login hook. Non-interactive commands (ssh host "cmd") need the opt-in ForceCommand wrapper.

Which shells are supported?

Any shell's session is recorded — the recorder captures the PTY, not the shell. The process tree is bash-specific: sh/dash, zsh, and fish sessions are fully captured in the transcript but do not get a structured tree.

Can I play recordings with asciinema?

Local recordings are standard asciinema v2 casts — asciinema play works directly. Central recordings are encrypted; export them first.

What does it cost to run?

One static Go binary, about 3.5 MB, CGO_ENABLED=0, zero runtime dependencies — no agent framework, no database. Recording is fail-open, so even a stopped daemon never blocks a login.

What happens if the daemon is down?

ghostshell rec records to ~/.local/share/ghostshell and the daemon ingests those files into the central store on its next start. A recording is never silently lost.

Is it really an audit boundary?

Read the security model — Ghost Shell is honest about this. It is an audit and visibility tool for cooperative environments, not tamper-proof enforcement.

What license is it under?

GPLv2 — see license. The source is at github.com/Karannnnn614/Ghost-Shell.