sudo: give every command run through sudo a terminal of its own

An agent the operator starts as the agent account through sudo (hq ADR 0266) would otherwise share the operator's terminal and could push keystrokes into their shell after it ends. sudo still runs without a terminal for the mesh's own tools, so nothing they do changes.
2026-10-08 20:41:06 +02:00
parent a3dd075393
commit 5db571666a
3 changed files with 6 additions and 3 deletions
@@ -20,7 +20,7 @@
      "type": "file",
      "path": "/etc/sudoers.d/10-mesh-operator",
      "mode": "0440",
-      "content": "# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates\n# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;\n# until this file, every machine said so only in a line set by hand in /etc/sudoers.\n# Written whole at every push: an edit here is overwritten. A file of this directory whose name\n# holds a dot or ends in ~ is not read by sudo; this name holds neither.\n${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL\n"
+      "content": "# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates\n# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;\n# until this file, every machine said so only in a line set by hand in /etc/sudoers.\n# Written whole at every push: an edit here is overwritten. A file of this directory whose name\n# holds a dot or ends in ~ is not read by sudo; this name holds neither.\n# Every command run through sudo gets a terminal of its own (novox/hq ADR 0266): an agent the operator\n# starts as the agent account through sudo cannot push keystrokes into the operator's shell (TIOCSTI).\nDefaults use_pty\n${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL\n"
    }
  ],
  "build": {