diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-20 15:46:32 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-20 15:46:32 -0500 |
| commit | 71029f3235a6567d0eb76f146cb2325b314d1bcf (patch) | |
| tree | 047a4d1fccbe1c65f640640f681d060425cca6ce /todo.org | |
| parent | 36daf763d4007eccbb5608de0e77278c2f5a1135 (diff) | |
| download | archsetup-71029f3235a6567d0eb76f146cb2325b314d1bcf.tar.gz archsetup-71029f3235a6567d0eb76f146cb2325b314d1bcf.zip | |
docs: close wireguard tunnel-ordering task
Diffstat (limited to 'todo.org')
| -rw-r--r-- | todo.org | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -1487,7 +1487,9 @@ CLOSED: [2026-07-20 Mon] Fixed in c80e855: extracted replace_sudoers_pacnew, which runs visudo -cf on the pacnew and only copies a validated file (warns and keeps the working sudoers otherwise). TDD via tests/installer-steps/test_replace_sudoers_pacnew.py. Grading: Major severity (a malformed sudoers locks out privilege escalation) x rare edge case = P3 = [#C]. archsetup:1146 does =[ -f /etc/sudoers.pacnew ] && cp /etc/sudoers.pacnew /etc/sudoers= with no validation, right before the NOPASSWD rule at 1183. Fix: =visudo -cf /etc/sudoers.pacnew && cp ... || error_warn=. See findings doc (S2). -** TODO [#C] WireGuard import leaves full-tunnel VPN live on failure :bug:solo:network: +** DONE [#C] WireGuard import leaves full-tunnel VPN live on failure :bug:solo:network: +CLOSED: [2026-07-20 Mon] +Fixed in 36daf76: the down now runs before the rename modify (targets the stable UUID), so a failed modify under set -e can't leave a live full-tunnel VPN. Added a connection-down case to fake-nmcli and two ordering tests. Grading: Major severity (all traffic silently routed through Proton until manual cleanup) x rare (nmcli modify failure) = P3 = [#C]. scripts/import-wireguard-configs.sh:51-62 imports (which brings the 0.0.0.0/0 tunnel up), renames, then deactivates; under set -e a failed modify aborts before the down, leaving the tunnel live. Fix: bring the connection down right after parsing the UUID, before the rename. See findings doc (S4). ** TODO [#C] Add inetutils to install base :feature:solo:quick:network: |