fail2ban's tools are a bundle the node's runtime serves; its container goes (hq to-be 38 WP4)

The second holder follows the packet filter: the container, its base images, the Dockerfile,
and the bus credential and state directory only the container read are gone; the tools are a
TypeScript bundle node-tools loads. The daemon's socket answers only to root, so the client
runs through sudo without a prompt where the runtime's account is not root, naming sudo's
absence or refusal by how it failed; client and daemon are the one package the module declares.

modules/fail2ban/client.ts

@@ -5,12 +5,15 @@
 // prevention seat's four verbs (ADR 0179). The daemon's state is fail2ban's, not the mesh's: the
 // mesh composes the jails and never writes the ban list.
 //
-// Spoken through fail2ban-client over the daemon's socket, which the machine shares into this
-// runtime; so the client here is the one from the runtime's own package and the daemon is the
-// machine's, and the two meet at /var/run/fail2ban/fail2ban.sock.
+// Spoken through fail2ban-client over the daemon's socket. Client and daemon come from the one
+// package this module declares on the machine, and the socket is root's: root is the module's
+// concern (ADR 0175 §4), and the runtime loading this bundle runs as the operator's account (to-be
+// 38 WP4), so the client is run through sudo without a prompt where the account is not root.
 
 import { execFile } from "node:child_process";
+import { accessSync, constants } from "node:fs";
 import { isIP } from "node:net";
+import { delimiter, join } from "node:path";
 import { promisify } from "node:util";
 
 const execFileP = promisify(execFile);
@@ -18,16 +21,44 @@ const execFileP = promisify(execFile);
 /** A command runner, so the verbs can be tested without a daemon. */
 export type Runner = (cmd: string, args: string[]) => Promise<string>;
 
+/** The command as it is run: as given when this process is root, else through sudo without a
+ *  prompt. The daemon's socket answers only to root. */
+export function escalated(cmd: string, args: string[], uid: number | undefined = process.getuid?.()): [string, string[]] {
+  if (uid === 0) return [cmd, args];
+  return ["sudo", ["-n", cmd, ...args]];
+}
+
+/** Whether a tool is on this machine: an executable of that name on the path, or where the
+ *  system keeps its administration. */
+export function installed(tool: string, path: string = process.env.PATH ?? ""): boolean {
+  const dirs = [...path.split(delimiter), "/usr/sbin", "/sbin", "/usr/bin"].filter((d) => d !== "");
+  return dirs.some((dir) => {
+    try {
+      accessSync(join(dir, tool), constants.X_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+}
+
 export const execRunner: Runner = async (cmd, args) => {
+  if (!installed(cmd)) throw new Error(`${cmd} is not installed on this machine`);
+  const [program, argv] = escalated(cmd, args);
   try {
-    const { stdout } = await execFileP(cmd, args, { maxBuffer: 16 * 1024 * 1024 });
+    const { stdout } = await execFileP(program, argv, { maxBuffer: 16 * 1024 * 1024 });
     return stdout;
   } catch (err) {
     const e = err as { code?: string | number; stderr?: string; stdout?: string; message?: string };
     const said = `${e.stdout ?? ""}${e.stderr ?? ""}`.trim();
-    if (e.code === "ENOENT") throw new Error(`${cmd} is not in this runtime`);
-    if (/Failed to access socket path|Is fail2ban running/i.test(said)) {
-      throw new Error("fail2ban is not running on this machine, or its socket is not shared with this runtime");
+    // What failed is named by how it failed: sudo missing is a spawn error, sudo refusing speaks
+    // on its own stderr line, and the rest is the client's own answer.
+    if (program === "sudo") {
+      if (e.code === "ENOENT") throw new Error(`${cmd} needs root, and sudo is not installed here for the runtime's account to escalate with`);
+      if (/^sudo:/m.test(said)) throw new Error(`${cmd} needs root and the runtime's account may not run it without a prompt: ${said}`);
+    }
+    if (/Failed to access socket path|Is fail2ban running|Permission denied to socket/i.test(said)) {
+      throw new Error("fail2ban is not running on this machine, or its socket does not answer the runtime's account");
     }
     // fail2ban-client's own last line is the one a person reads ("Sorry but the jail 'x' does not exist").
     const lines = said.split("\n").map((l) => l.trim()).filter(Boolean);
@@ -76,7 +107,8 @@ export class Fail2banClient {
     this.run = run;
   }
 
-  static fromEnv(_env: NodeJS.ProcessEnv = process.env): Fail2banClient {
+  /** The daemon as this machine has it, through its own client. */
+  static onThisMachine(): Fail2banClient {
     return new Fail2banClient();
   }