admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sudoers: escape commas in lvs/lsblk -o arg lists (visudo -cf rejected the file)

Browse Source 
Bare commas are command separators in sudoers; the lvs/lsblk -o option lists need
escaped commas. The file had never been visudo-validated live (the demo host ran the
agent root+direct). Surfaced by the BUNDLE host-install visudo -cf gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-28 08:56:16 +02:00
parent 29aeaa6bb4
commit a8d14fc384
2 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+6
View File
@@ -33,6 +33,12 @@ tooling; the binary itself is a version-only rebuild (no behavioural change).
to `/api/packages/admin/generic/felhom-golden/<golden-version>/golden.tar.zst` (`<golden-version>` = to `/api/packages/admin/generic/felhom-golden/<golden-version>/golden.tar.zst` (`<golden-version>` =
the baked controller version), printing `GOLDEN_VERSION` + `GOLDEN_SHA256`. Opt-in (only when the the baked controller version), printing `GOLDEN_VERSION` + `GOLDEN_SHA256`. Opt-in (only when the
Gitea creds are set); the local-golden auto-discovery stays as a fallback. Gitea creds are set); the local-golden auto-discovery stays as a fallback.
- **`configs/felhom-agent.sudoers` (latent bug fix):** escaped the commas in the `lvs -o
lv_name\,data_percent\,metadata_percent` and `lsblk -o NAME\,FSTYPE\,PTTYPE\,MOUNTPOINT` argument
lists. Sudoers treats a bare comma as a command separator, so `visudo -cf` REJECTED the file — it had
never been visudo-validated live because the demo host ran the agent as root+`direct` (sudoers
unused). The escaped commas still match the agent's real comma-bearing args. Surfaced by the BUNDLE
live install (the host-install script `visudo -cf`-validates before installing).
- **`cmd/felhom-agent/main.go`:** `version` 0.42.0 → 0.43.0. - **`cmd/felhom-agent/main.go`:** `version` 0.42.0 → 0.43.0.
- The operator records the printed agent + golden version+sha256 in the hub (Configs → "Day-0 - The operator records the printed agent + golden version+sha256 in the hub (Configs → "Day-0
artifacts"); the host-bootstrap script verifies fetched artifacts against those before installing. artifacts"); the host-bootstrap script verifies fetched artifacts against those before installing.
configs/felhom-agent.sudoers
+2 -2
View File
@@ -24,7 +24,7 @@ Cmnd_Alias FELHOM_DISK = \
/usr/sbin/smartctl -a -j /dev/nvme[0-9]*n[0-9]*, \ /usr/sbin/smartctl -a -j /dev/nvme[0-9]*n[0-9]*, \
/usr/sbin/smartctl -a -j /dev/vd[a-z]*, \ /usr/sbin/smartctl -a -j /dev/vd[a-z]*, \
/usr/sbin/smartctl -a -j /dev/hd[a-z]*, \ /usr/sbin/smartctl -a -j /dev/hd[a-z]*, \
/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- * /usr/sbin/lvs --reportformat json --units b -o lv_name\,data_percent\,metadata_percent -- *
# Provisioning back-half (slice 8A, doc 03 §6): populate a guest's bootstrap config mount # Provisioning back-half (slice 8A, doc 03 §6): populate a guest's bootstrap config mount
# host-side (internal/provision). These are host-root ops the API token cannot do — a bind mount # host-side (internal/provision). These are host-root ops the API token cannot do — a bind mount
@@ -43,7 +43,7 @@ Cmnd_Alias FELHOM_PROVISION = \
# only) + fstype before any exec — the wildcard is the coarse allowlist, the agent is the fine gate. # only) + fstype before any exec — the wildcard is the coarse allowlist, the agent is the fine gate.
Cmnd_Alias FELHOM_FORMAT = \ Cmnd_Alias FELHOM_FORMAT = \
/usr/sbin/blkid -p -o export /dev/*, \ /usr/sbin/blkid -p -o export /dev/*, \
/usr/bin/lsblk -J -o NAME,FSTYPE,PTTYPE,MOUNTPOINT /dev/*, \ /usr/bin/lsblk -J -o NAME\,FSTYPE\,PTTYPE\,MOUNTPOINT /dev/*, \
/usr/sbin/mkfs.ext4 -F /dev/*, \ /usr/sbin/mkfs.ext4 -F /dev/*, \
/usr/sbin/mkfs.xfs -f /dev/* /usr/sbin/mkfs.xfs -f /dev/*