coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity

fix(P19): sudoers hardening — remove apt-get/dpkg (REQ-134, F22)

Browse Source 
---ci---
project: orca
phase: 19
milestone: v0.12
status: execute
---/ci---

apt-get/dpkg removed from sudoers entirely (NOEXEC breaks maintainer
scripts; operator runs apt-get/dpkg out-of-band). Only pct + qm remain
(both NOEXEC). Tests updated. Build green.
This commit is contained in:
Jon Chery
2026-08-07 11:29:26 +00:00
parent 3269e1cb1d
commit da682f1017
2 changed files with 7 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/proxmox/bootstrap.go
+3 -3
View File
@@ -449,9 +449,9 @@ func sudoersContent(user string) string {
# pvesh is EXCLUDED (AD-020: pvesh can bypass NOEXEC via API execute). # pvesh is EXCLUDED (AD-020: pvesh can bypass NOEXEC via API execute).
%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct
%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/qm %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/qm
%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/apt-get
%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/dpkg
`, user, user, user, user) `, user, user)
} }
// writeSudoers writes the /etc/sudoers.d/orca file on the remote host // writeSudoers writes the /etc/sudoers.d/orca file on the remote host
internal/proxmox/bootstrap_test.go
+4 -10
View File
@@ -33,17 +33,11 @@ func TestSudoersContent(t *testing.T) {
t.Error("missing NOEXEC on qm (AD-020)") t.Error("missing NOEXEC on qm (AD-020)")
} }
if !strings.Contains(content, "NOPASSWD: /usr/bin/apt-get") { if strings.Contains(content, "apt-get") {
t.Error("missing NOPASSWD on apt-get") t.Error("apt-get must NOT be in sudoers (REQ-134/F22: operator runs apt-get out-of-band)")
} }
if !strings.Contains(content, "NOPASSWD: /usr/bin/dpkg") { if strings.Contains(content, "dpkg") {
t.Error("missing NOPASSWD on dpkg") t.Error("dpkg must NOT be in sudoers (REQ-134/F22: operator runs dpkg out-of-band)")
}
if strings.Contains(content, "NOEXEC: /usr/bin/apt-get") {
t.Error("apt-get must NOT have NOEXEC (breaks maintainer scripts)")
}
if strings.Contains(content, "NOEXEC: /usr/bin/dpkg") {
t.Error("dpkg must NOT have NOEXEC (breaks maintainer scripts)")
} }
for _, line := range strings.Split(content, "\n") { for _, line := range strings.Split(content, "\n") {