novox/mesh-catalog
6
0
Fork 0
Code Issues Pull Requests 5 Actions Packages Projects Releases Wiki Activity

sudo: give every command run through sudo a terminal of its own

Browse Source 
An agent the operator starts as the agent account through sudo (hq ADR 0266)
would otherwise share the operator's terminal and could push keystrokes into
their shell after it ends. sudo still runs without a terminal for the mesh's
own tools, so nothing they do changes.
This commit is contained in:
jochen
2026-10-09 10:14:25 +02:00
parent 17b0ac9f6c
commit 9afea75f93
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/sudo/README.md
+4 -1
View File
@@ -6,7 +6,10 @@ Privilege escalation as a module (novox/hq to-be 42 Phase 1, research 027).
- The `sudo` package.
- `/etc/sudoers.d/10-mesh-operator`, root's, mode 0440, written whole:
`<operator account> ALL=(ALL:ALL) NOPASSWD: ALL`.
`<operator account> ALL=(ALL:ALL) NOPASSWD: ALL`, and `Defaults use_pty`: a command run through sudo gets a
terminal of its own, so an agent the operator starts as the agent account (hq ADR 0266) cannot push
keystrokes into the operator's shell. The rule names the operator account and nobody else: the agent
account has no sudo.
That one line is what the mesh's acting tools assume: the packet filter, the service manager and the
intrusion prevention tools act through `sudo -n` as the operator account (to-be 38 WP4). Before this
modules/sudo/cmd/sudo-tools/manifest_test.go
+1 -1
View File
@@ -41,7 +41,7 @@ func TestTheDropInGrantsExactlyTheOperatorAccountAndParses(t *testing.T) {
rules = append(rules, l)
}
}
if len(rules) != 1 || rules[0] != "${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL" {
if len(rules) != 2 || rules[0] != "Defaults use_pty" || rules[1] != "${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL" {
t.Fatalf("rules: %q", rules)
}
if !strings.HasSuffix(content, "\n") {
modules/sudo/module.json
+1 -1
View File
@@ -20,7 +20,7 @@
"type": "file",
"path": "/etc/sudoers.d/10-mesh-operator",
"mode": "0440",
"content": "# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates\n# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;\n# until this file, every machine said so only in a line set by hand in /etc/sudoers.\n# Written whole at every push: an edit here is overwritten. A file of this directory whose name\n# holds a dot or ends in ~ is not read by sudo; this name holds neither.\n${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL\n"
"content": "# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates\n# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;\n# until this file, every machine said so only in a line set by hand in /etc/sudoers.\n# Written whole at every push: an edit here is overwritten. A file of this directory whose name\n# holds a dot or ends in ~ is not read by sudo; this name holds neither.\n# Every command run through sudo gets a terminal of its own (novox/hq ADR 0266): an agent the operator\n# starts as the agent account through sudo cannot push keystrokes into the operator's shell (TIOCSTI).\nDefaults use_pty\n${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL\n"
}
],
"build": {