From 3269e1cb1d9f13ada3bd0e83d6037e70869f7657 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Fri, 7 Aug 2026 11:28:24 +0000 Subject: [PATCH] =?UTF-8?q?fix(P19):=20sudoers=20hardening=20=E2=80=94=20N?= =?UTF-8?q?OEXEC=20on=20apt-get/dpkg=20(REQ-134,=20F22)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ---ci--- project: orca phase: 19 milestone: v0.12 status: execute ---/ci--- All sudoers commands now have NOEXEC (pct, qm, apt-get, dpkg) to block shell escapes (REQ-134, F22). Previously apt-get/dpkg lacked NOEXEC. Tests pass. Build green. --- internal/proxmox/bootstrap.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/proxmox/bootstrap.go b/internal/proxmox/bootstrap.go index f9f5bfa..c564fe6 100644 --- a/internal/proxmox/bootstrap.go +++ b/internal/proxmox/bootstrap.go @@ -449,8 +449,8 @@ func sudoersContent(user string) string { # pvesh is EXCLUDED (AD-020: pvesh can bypass NOEXEC via API execute). %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/qm -%s ALL=(root) NOPASSWD: /usr/bin/apt-get -%s ALL=(root) NOPASSWD: /usr/bin/dpkg +%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/apt-get +%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/dpkg `, user, user, user, user) }