# sudo

Privilege escalation as a module (novox/hq to-be 42 Phase 1, research 027).

## What it owns

- The `sudo` package.
- `/etc/sudoers.d/10-mesh-operator`, root's, mode 0440, written whole:
  `<operator account> ALL=(ALL:ALL) NOPASSWD: ALL`, and `Defaults use_pty`: a command run through sudo gets a
  terminal of its own, so an agent the operator starts as the agent account (hq ADR 0266) cannot push
  keystrokes into the operator's shell. The rule names the operator account and nobody else: the agent
  account has no sudo.

That one line is what the mesh's acting tools assume: the packet filter, the service manager and the
intrusion prevention tools act through `sudo -n` as the operator account (to-be 38 WP4). Before this
module, nothing declared it. Each machine said it in its own line in `/etc/sudoers`, set by hand: a
`wheel` group rule on two machines, the account by name on the other two.

A sudoers file that does not parse locks sudo for every account. The manifest test renders the drop-in
for several account names and runs `visudo -cf` on each. It skips that check where visudo is not
installed.

## What it improves

- The escalation is declared once, the same on every machine, and readable through its tools.
- `lab` no longer declares the `sudo` package (novox/hq ADR 0207: a component's package belongs to one
  module). Lab's tools still rely on sudo, and this module provides it on every machine.

## What it leaves found

- `/etc/sudoers` itself: its `root` line, the hand-set grants (`%wheel`, the account by name,
  `%sudo`), and its `@includedir`. They are redundant beside the drop-in, and removing them is a
  person's act on each machine (ADR 0182). `sudo_check` shows each grant and the one that decides.
- Every other file in `/etc/sudoers.d`.

## Tools

| tool | | answers |
|---|---|---|
| `sudo_rules` | r | `sudo -n -l` parsed: the defaults, and each rule with its run-as, tags and commands; `passwordless_all` |
| `sudo_check` | r | whether `sudo -n` works, every grant naming the account, its groups or `ALL` in the order sudo reads them, the one that decides, and whether the module's drop-in is present |
| `sudo_drop_ins` | r | `/etc/sudoers.d` with owner, mode, size, whether sudo reads each file (name, owner, mode), whether each parses, and whether the whole parses |

The tools change nothing. They read root-only files through `sudo -n`, and a refusal is an answer, not
an empty list.