Manage claim-rotate.sh + gate that sudoers grants are overlay-provided - #221
Merged
Conversation
The Rotate-secret feature added a privileged wrapper at /usr/local/lib/airplanes-webconfig/claim-rotate.sh plus a sudoers grant for it. The sudoers file and the webconfig binary are already covered by managed_paths, but the wrapper itself had no entry — so a freshly flashed image carries it (the rootfs ships it) while a feeder updated via the runtime overlay would get the grant pointing at a script that isn't linked into place, breaking rotation. Add the missing symlink entry, mirroring the identity-export/identity-import wrappers.
Add a release gate (sudoers-managed-check.sh, wired into verify-gates.sh) that fails the build when a staged sudoers NOPASSWD command path is not provided by a managed_paths entry and is not a base-OS binary under /usr/bin, /bin, /usr/sbin, or /sbin. This is the cross-repo invariant that was missing: a privileged helper granted in image-webconfig but unmanaged here flashes fine yet breaks on an in-place overlay update. The gate would have caught the claim-rotate.sh omission this PR also fixes.
d4rken
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Rotate-secret feature ships a privileged helper script and a sudoers grant that invokes it. The sudoers file and the webconfig binary are already part of the runtime overlay's managed paths, but the helper script itself was not — so a freshly flashed image works (its rootfs carries the script), while a feeder updated in place via the runtime overlay would receive the grant without the script it points at, and rotation would fail.
This adds the missing managed-path entry for the helper (mirroring the existing identity export/import wrappers) so an on-device update delivers it too.
It also adds a release gate that prevents this whole class of gap: every
NOPASSWDcommand path in the staged sudoers must be provided by a managed-path entry or be a base-OS binary, or the build fails. The grant and the helper are authored in another repo, so nothing previously cross-checked that an update actually delivers what a grant points at; this gate is that check, and it would have caught the omission above.