novox/mesh-catalog
8
0
Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases Wiki Activity

sudo: give every command run through sudo a terminal of its own

Browse Source 
An agent the operator starts as the agent account through sudo (hq ADR 0266)
would otherwise share the operator's terminal and could push keystrokes into
their shell after it ends. sudo still runs without a terminal for the mesh's
own tools, so nothing they do changes.
This commit is contained in:
jochen
2026-10-09 10:14:25 +02:00
parent 17b0ac9f6c
commit 9afea75f93
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/sudo/README.md
+4 -1
View File
@@ -6,7 +6,10 @@ Privilege escalation as a module (novox/hq to-be 42 Phase 1, research 027).
- The `sudo` package.
- `/etc/sudoers.d/10-mesh-operator`, root's, mode 0440, written whole:
`<operator account> ALL=(ALL:ALL) NOPASSWD: ALL`.
`<operator account> ALL=(ALL:ALL) NOPASSWD: ALL`, and `Defaults use_pty`: a command run through sudo gets a
terminal of its own, so an agent the operator starts as the agent account (hq ADR 0266) cannot push
keystrokes into the operator's shell. The rule names the operator account and nobody else: the agent
account has no sudo.
That one line is what the mesh's acting tools assume: the packet filter, the service manager and the
intrusion prevention tools act through `sudo -n` as the operator account (to-be 38 WP4). Before this