From a8d14fc3843253be3d120f91ff03c9b080f4b2dc Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 28 Jun 2026 08:56:16 +0200 Subject: [PATCH] sudoers: escape commas in lvs/lsblk -o arg lists (visudo -cf rejected the file) Bare commas are command separators in sudoers; the lvs/lsblk -o option lists need escaped commas. The file had never been visudo-validated live (the demo host ran the agent root+direct). Surfaced by the BUNDLE host-install visudo -cf gate. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 6 ++++++ configs/felhom-agent.sudoers | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2865941..4fae66a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -33,6 +33,12 @@ tooling; the binary itself is a version-only rebuild (no behavioural change). to `/api/packages/admin/generic/felhom-golden//golden.tar.zst` (`` = the baked controller version), printing `GOLDEN_VERSION` + `GOLDEN_SHA256`. Opt-in (only when the Gitea creds are set); the local-golden auto-discovery stays as a fallback. +- **`configs/felhom-agent.sudoers` (latent bug fix):** escaped the commas in the `lvs -o + lv_name\,data_percent\,metadata_percent` and `lsblk -o NAME\,FSTYPE\,PTTYPE\,MOUNTPOINT` argument + lists. Sudoers treats a bare comma as a command separator, so `visudo -cf` REJECTED the file — it had + never been visudo-validated live because the demo host ran the agent as root+`direct` (sudoers + unused). The escaped commas still match the agent's real comma-bearing args. Surfaced by the BUNDLE + live install (the host-install script `visudo -cf`-validates before installing). - **`cmd/felhom-agent/main.go`:** `version` 0.42.0 → 0.43.0. - The operator records the printed agent + golden version+sha256 in the hub (Configs → "Day-0 artifacts"); the host-bootstrap script verifies fetched artifacts against those before installing. diff --git a/configs/felhom-agent.sudoers b/configs/felhom-agent.sudoers index 7926077..517c994 100644 --- a/configs/felhom-agent.sudoers +++ b/configs/felhom-agent.sudoers @@ -24,7 +24,7 @@ Cmnd_Alias FELHOM_DISK = \ /usr/sbin/smartctl -a -j /dev/nvme[0-9]*n[0-9]*, \ /usr/sbin/smartctl -a -j /dev/vd[a-z]*, \ /usr/sbin/smartctl -a -j /dev/hd[a-z]*, \ - /usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- * + /usr/sbin/lvs --reportformat json --units b -o lv_name\,data_percent\,metadata_percent -- * # Provisioning back-half (slice 8A, doc 03 §6): populate a guest's bootstrap config mount # host-side (internal/provision). These are host-root ops the API token cannot do — a bind mount @@ -43,7 +43,7 @@ Cmnd_Alias FELHOM_PROVISION = \ # only) + fstype before any exec — the wildcard is the coarse allowlist, the agent is the fine gate. Cmnd_Alias FELHOM_FORMAT = \ /usr/sbin/blkid -p -o export /dev/*, \ - /usr/bin/lsblk -J -o NAME,FSTYPE,PTTYPE,MOUNTPOINT /dev/*, \ + /usr/bin/lsblk -J -o NAME\,FSTYPE\,PTTYPE\,MOUNTPOINT /dev/*, \ /usr/sbin/mkfs.ext4 -F /dev/*, \ /usr/sbin/mkfs.xfs -f /dev/*