jochen
9afea75f93
An agent the operator starts as the agent account through sudo (hq ADR 0266) would otherwise share the operator's terminal and could push keystrokes into their shell after it ends. sudo still runs without a terminal for the mesh's own tools, so nothing they do changes.
42 lines
1.4 KiB
JSON
42 lines
1.4 KiB
JSON
{
|
|
"module": "sudo",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"package-manager"
|
|
],
|
|
"tools": [
|
|
"sudo_rules",
|
|
"sudo_check",
|
|
"sudo_drop_ins"
|
|
],
|
|
"resources": [
|
|
{
|
|
"id": "package",
|
|
"type": "package",
|
|
"package": "sudo"
|
|
},
|
|
{
|
|
"id": "operator",
|
|
"type": "file",
|
|
"path": "/etc/sudoers.d/10-mesh-operator",
|
|
"mode": "0440",
|
|
"content": "# The mesh's (module sudo, novox/hq to-be 42, research 027): the operator account escalates\n# without a prompt. The mesh's tools that act as root run `sudo -n` as this account and rely on it;\n# until this file, every machine said so only in a line set by hand in /etc/sudoers.\n# Written whole at every push: an edit here is overwritten. A file of this directory whose name\n# holds a dot or ends in ~ is not read by sudo; this name holds neither.\n# Every command run through sudo gets a terminal of its own (novox/hq ADR 0266): an agent the operator\n# starts as the agent account through sudo cannot push keystrokes into the operator's shell (TIOCSTI).\nDefaults use_pty\n${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL\n"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "tools",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/sudo-tools",
|
|
"binary": "sudo-tools",
|
|
"loads": [
|
|
"sudo-tools"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|