super/box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NetVM: sudoers file sorts last (zz-) so NOPASSWD beats blanket grants

Browse Source
This commit is contained in:
Antigravity Agent
2026-10-03 00:17:41 -04:00
parent 626918ff94
commit 8ba8e3d7ec
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/netvm-provision-edge.sh
+2 -2
View File
@@ -7,7 +7,7 @@ set -euo pipefail
OPERATOR_USER="${OPERATOR_USER:-$(whoami)}" OPERATOR_USER="${OPERATOR_USER:-$(whoami)}"
REPO="$HOME/Projects/NetVM" REPO="$HOME/Projects/NetVM"
SUDOERS_FILE="/etc/sudoers.d/netvm-operator" SUDOERS_FILE="/etc/sudoers.d/zz-netvm-operator"
echo "== NetVM edge provisioning (operator user: $OPERATOR_USER) ==" echo "== NetVM edge provisioning (operator user: $OPERATOR_USER) =="
@@ -29,7 +29,7 @@ fi
# 3. sudoers allowlist: exact lifecycle scripts only, never blanket root # 3. sudoers allowlist: exact lifecycle scripts only, never blanket root
sudo tee "$SUDOERS_FILE" > /dev/null << SUDOERS sudo tee "$SUDOERS_FILE" > /dev/null << SUDOERS
# NetVM operator lifecycle access — managed by netvm-provision-edge.sh. # NetVM operator lifecycle access — managed by netvm-provision-edge.sh. Named zz- so it sorts last: in sudoers the LAST matching entry wins, and this must beat any blanket (ALL) grant.
# Lets the operator user bring node egress up/down and read topology. # Lets the operator user bring node egress up/down and read topology.
# WireGuard configs in /etc/netvm stay root-only; these scripts never print them. # WireGuard configs in /etc/netvm stay root-only; these scripts never print them.
$OPERATOR_USER ALL=(root) NOPASSWD: $REPO/bin/netvm-node-up.sh *, $REPO/bin/netvm-node-down.sh *, $REPO/bin/netvm-topology.sh $OPERATOR_USER ALL=(root) NOPASSWD: $REPO/bin/netvm-node-up.sh *, $REPO/bin/netvm-node-down.sh *, $REPO/bin/netvm-topology.sh