Files

T

jochen 9afea75f93 sudo: give every command run through sudo a terminal of its own

An agent the operator starts as the agent account through sudo (hq ADR 0266)
would otherwise share the operator's terminal and could push keystrokes into
their shell after it ends. sudo still runs without a terminal for the mesh's
own tools, so nothing they do changes.

2026-10-09 10:14:25 +02:00

2.4 KiB

Raw Blame History

sudo

Privilege escalation as a module (novox/hq to-be 42 Phase 1, research 027).

What it owns

The sudo package.
/etc/sudoers.d/10-mesh-operator, root's, mode 0440, written whole: <operator account> ALL=(ALL:ALL) NOPASSWD: ALL, and Defaults use_pty: a command run through sudo gets a terminal of its own, so an agent the operator starts as the agent account (hq ADR 0266) cannot push keystrokes into the operator's shell. The rule names the operator account and nobody else: the agent account has no sudo.

That one line is what the mesh's acting tools assume: the packet filter, the service manager and the intrusion prevention tools act through sudo -n as the operator account (to-be 38 WP4). Before this module, nothing declared it. Each machine said it in its own line in /etc/sudoers, set by hand: a wheel group rule on two machines, the account by name on the other two.

A sudoers file that does not parse locks sudo for every account. The manifest test renders the drop-in for several account names and runs visudo -cf on each. It skips that check where visudo is not installed.

What it improves

The escalation is declared once, the same on every machine, and readable through its tools.
lab no longer declares the sudo package (novox/hq ADR 0207: a component's package belongs to one module). Lab's tools still rely on sudo, and this module provides it on every machine.

What it leaves found

/etc/sudoers itself: its root line, the hand-set grants (%wheel, the account by name, %sudo), and its @includedir. They are redundant beside the drop-in, and removing them is a person's act on each machine (ADR 0182). sudo_check shows each grant and the one that decides.
Every other file in /etc/sudoers.d.

Tools

tool		answers
`sudo_rules`	r	`sudo -n -l` parsed: the defaults, and each rule with its run-as, tags and commands; `passwordless_all`
`sudo_check`	r	whether `sudo -n` works, every grant naming the account, its groups or `ALL` in the order sudo reads them, the one that decides, and whether the module's drop-in is present
`sudo_drop_ins`	r	`/etc/sudoers.d` with owner, mode, size, whether sudo reads each file (name, owner, mode), whether each parses, and whether the whole parses

The tools change nothing. They read root-only files through sudo -n, and a refusal is an answer, not an empty list.

2.4 KiB Raw Blame History