Five servers grant blanket passwordless sudo; `policies/sudo` covers only odin #14

Open

opened 2026-08-04 07:56:35 +00:00 by agent.odin · 0 comments

agent.odin commented

2026-08-04 07:56:35 +00:00

Collaborator

Stable ID: FM-AUDIT-06
Source: modules/policies/sudo.nix, all five server host files
Source status: new finding, not previously tracked
Disposition: open owner decision — security posture
Epic: #9
Blocked by: owner decision on the server posture

Problem

policies/sudo is careful. It grants NOPASSWD to podman and to exactly the
systemctl lifecycle verbs, with its own comment saying why:

Only lifecycle verbs — unrestricted systemctl (edit, set-property, link)
would be passwordless root.

That aspect is in one host's roots: odin. The five servers do not select it —
common in modules/aspects/hosts.nix:14-19 is integrations/mesh-whoami,
policies/mesh, services/node-exporter, services/openssh.

Each server instead writes, verbatim:

security.sudo.wheelNeedsPassword = false;

bifrost:85, fenrisulfr:77, heimdallr:56, modron:55, tamiel:20.

So the fleet's considered sudo policy protects the workstation, and every
server — including heimdallr, which holds the fleet identity secrets, and
fenrisulfr, which holds the vault NFS mounts — has blanket passwordless root
for wheel. Five identical lines is the tell: this is a fleet policy that was
never written as one.

Decision needed

Is blanket passwordless sudo the intended server posture, or an accident that
propagated by copy-paste? Both are defensible for a single-operator fleet
reached only over the mesh with key-only ssh — but it should be a decision.

Acceptance

The posture decided and recorded here.
Whatever it is, expressed once — in policies/sudo or a sibling policy — and
added to common in modules/aspects/hosts.nix.
The five verbatim wheelNeedsPassword lines gone from the host files.

Provenance

Split from #9 (FM-ASPECT-AUDIT). Audit run 2026-08-04 by agent.odin against commit fc3b751, with modules/implementations/{forgejo-agents,hermes}.nix and outputs/hosts/odin/{configuration.nix,secrets.agents.yaml} dirty in the working copy.

Stable ID: FM-AUDIT-06 Source: `modules/policies/sudo.nix`, all five server host files Source status: new finding, not previously tracked Disposition: open owner decision — security posture Epic: #9 Blocked by: owner decision on the server posture ## Problem `policies/sudo` is careful. It grants NOPASSWD to podman and to exactly the systemctl lifecycle verbs, with its own comment saying why: > Only lifecycle verbs — unrestricted systemctl (edit, set-property, link) > would be passwordless root. That aspect is in one host's roots: odin. The five servers do not select it — `common` in `modules/aspects/hosts.nix:14-19` is `integrations/mesh-whoami`, `policies/mesh`, `services/node-exporter`, `services/openssh`. Each server instead writes, verbatim: ```nix security.sudo.wheelNeedsPassword = false; ``` bifrost:85, fenrisulfr:77, heimdallr:56, modron:55, tamiel:20. So the fleet's considered sudo policy protects the workstation, and every server — including heimdallr, which holds the fleet identity secrets, and fenrisulfr, which holds the vault NFS mounts — has blanket passwordless root for wheel. Five identical lines is the tell: this is a fleet policy that was never written as one. ## Decision needed Is blanket passwordless sudo the intended server posture, or an accident that propagated by copy-paste? Both are defensible for a single-operator fleet reached only over the mesh with key-only ssh — but it should be a decision. ## Acceptance - The posture decided and recorded here. - Whatever it is, expressed once — in `policies/sudo` or a sibling policy — and added to `common` in `modules/aspects/hosts.nix`. - The five verbatim `wheelNeedsPassword` lines gone from the host files. ## Provenance Split from #9 (FM-ASPECT-AUDIT). Audit run 2026-08-04 by agent.odin against commit `fc3b751`, with `modules/implementations/{forgejo-agents,hermes}.nix` and `outputs/hosts/odin/{configuration.nix,secrets.agents.yaml}` dirty in the working copy.