diff options
| author | Craig Jennings <c@cjennings.net> | 2026-07-20 15:44:48 -0500 |
|---|---|---|
| committer | Craig Jennings <c@cjennings.net> | 2026-07-20 15:44:48 -0500 |
| commit | 948a1fc0fbc300076b6f5b605a6a555c1b50e66a (patch) | |
| tree | 679dce4d844363c4def2f6fa36d6c2b21682f2c2 /todo.org | |
| parent | c80e85545be3b1ab98b69771f502b7b36102c7f6 (diff) | |
| download | archsetup-948a1fc0fbc300076b6f5b605a6a555c1b50e66a.tar.gz archsetup-948a1fc0fbc300076b6f5b605a6a555c1b50e66a.zip | |
docs: close sudoers.pacnew validation task
Diffstat (limited to 'todo.org')
| -rw-r--r-- | todo.org | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -1482,7 +1482,9 @@ archsetup:298 marks a step complete only when its function returns 0, but error_ ** TODO [#C] cmail password decrypted world-readable before chmod :bug:security:solo:quick:cmail: Grading: security carve-out — brief local plaintext exposure of the mail password, requires a concurrent local shell during install; narrow window = low severity = P3 = [#C]. scripts/cmail-setup-finish.sh:52 gpg-decrypts to ~/.config/.cmailpass at the process umask (often 0644), then chmod 600 on the next line. Fix: =(umask 077; gpg ... --output ...)= or decrypt to a mktemp 0600 file and mv into place (mirror the import-wireguard mktemp -d 0700 pattern). See findings doc (S4). -** TODO [#C] Installer sudoers.pacnew blind copy risks lockout :bug:solo:quick: +** DONE [#C] Installer sudoers.pacnew blind copy risks lockout :bug:solo:quick: +CLOSED: [2026-07-20 Mon] +Fixed in c80e855: extracted replace_sudoers_pacnew, which runs visudo -cf on the pacnew and only copies a validated file (warns and keeps the working sudoers otherwise). TDD via tests/installer-steps/test_replace_sudoers_pacnew.py. Grading: Major severity (a malformed sudoers locks out privilege escalation) x rare edge case = P3 = [#C]. archsetup:1146 does =[ -f /etc/sudoers.pacnew ] && cp /etc/sudoers.pacnew /etc/sudoers= with no validation, right before the NOPASSWD rule at 1183. Fix: =visudo -cf /etc/sudoers.pacnew && cp ... || error_warn=. See findings doc (S2). ** TODO [#C] WireGuard import leaves full-tunnel VPN live on failure :bug:solo:network: |