sudo: count any sudo rule as root, fail on what cannot be judged, and commit no binary

The review of 2026-10-09: an unknown account and sudo that could not be asked were answered not root, and
only NOPASSWD on ALL counted, though NOPASSWD on systemctl, tee, bash or pacman reaches root as surely,
and a password the person typed is kept by sudo for minutes. Any rule now counts, as the node-engine's
own judge of an agent account does (ADR 0266); what cannot be judged fails the answer. The bundle built
in the module's directory is removed and ignored.

This commit is contained in:

jschoubben

2026-10-09 17:08:17 +02:00

parent c1d299336b

commit f30089c288

5 changed files with 120 additions and 48 deletions

modules/sudo/.gitignore

View File

@@ -0,0 +1,2 @@
 # The bundle built here (manifest build.artifacts[0].binary): never committed.
 /sudo-tools