From 71029f3235a6567d0eb76f146cb2325b314d1bcf Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Mon, 20 Jul 2026 15:46:32 -0500 Subject: docs: close wireguard tunnel-ordering task --- todo.org | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/todo.org b/todo.org index b431b99..b9d7265 100644 --- a/todo.org +++ b/todo.org @@ -1487,7 +1487,9 @@ CLOSED: [2026-07-20 Mon] Fixed in c80e855: extracted replace_sudoers_pacnew, which runs visudo -cf on the pacnew and only copies a validated file (warns and keeps the working sudoers otherwise). TDD via tests/installer-steps/test_replace_sudoers_pacnew.py. Grading: Major severity (a malformed sudoers locks out privilege escalation) x rare edge case = P3 = [#C]. archsetup:1146 does =[ -f /etc/sudoers.pacnew ] && cp /etc/sudoers.pacnew /etc/sudoers= with no validation, right before the NOPASSWD rule at 1183. Fix: =visudo -cf /etc/sudoers.pacnew && cp ... || error_warn=. See findings doc (S2). -** TODO [#C] WireGuard import leaves full-tunnel VPN live on failure :bug:solo:network: +** DONE [#C] WireGuard import leaves full-tunnel VPN live on failure :bug:solo:network: +CLOSED: [2026-07-20 Mon] +Fixed in 36daf76: the down now runs before the rename modify (targets the stable UUID), so a failed modify under set -e can't leave a live full-tunnel VPN. Added a connection-down case to fake-nmcli and two ordering tests. Grading: Major severity (all traffic silently routed through Proton until manual cleanup) x rare (nmcli modify failure) = P3 = [#C]. scripts/import-wireguard-configs.sh:51-62 imports (which brings the 0.0.0.0/0 tunnel up), renames, then deactivates; under set -e a failed modify aborts before the down, leaving the tunnel live. Fix: bring the connection down right after parsing the UUID, before the rename. See findings doc (S4). ** TODO [#C] Add inetutils to install base :feature:solo:quick:network: -- cgit v1.2.3