Consolidate sudoers configuration (4 separate sudoers commits in 7d window) #5
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally filed by @coilysiren on 2026-05-09T05:00:02Z - https://github.com/coilysiren/sirens-discord-ops/issues/7
The sudoers config was edited four times in the last week: each commit added one missing nopasswd permission for systemctl operations. This pattern suggests the underlying spec needs one consolidated definition rather than incremental whack-a-mole.
Cited commits:
5040713- sudoers: nopasswd start and stop in addition to restart and statusa51603a- sudoers: explicit --no-pager variant for status4261de5- sudoers: also nopasswd 'systemctl status' for diagnostic accessWhy this might matter: sudoers is security-sensitive surface. Iterative additions risk leaving stale broader rules behind. One audit pass ("what does the bot actually need to systemctl?") and a single clean grant block would close the loop. Worth doing now while context is fresh, before the next nopasswd request.
Keywords: sudoers systemctl nopasswd permissions deploy