28allday
19fd794b6b
Single-script builder (nosignal.sh) that turns a stock Arch Linux ISO into a fully-offline installer for a themed Hyprland + caelestia (Quickshell) desktop: matching SDDM greeter, Btrfs/Limine bootable snapshots, chwd-style GPU detection, and a curated "os updates" layer (keybind cheatsheet, settings panels, system polish, on-box management skill). See README.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
79 lines
3.9 KiB
Markdown
79 lines
3.9 KiB
Markdown
# sudo-timed-nopasswd — time-boxed passwordless sudo ("sudoless" mode)
|
|
|
|
Writes to `/usr/local/bin`, installs a systemd unit, and patches caelestia
|
|
— all need root. Install with the command below.
|
|
|
|
## What it is
|
|
A Settings → Services toggle (and a CLI) that grants the user **`NOPASSWD: ALL`
|
|
for 15 minutes**, then automatically reverts. For batches of admin work without
|
|
re-typing your password each time — bounded so it can't be left on forever.
|
|
|
|
Inspired by Omarchy's install-time `/etc/sudoers.d/first-run` (which is just
|
|
`$USER ALL=(ALL) NOPASSWD: /usr/bin/systemctl`, removed after first-run — see
|
|
omarchy issue #5708). This is the deliberate, user-triggered, time-boxed,
|
|
full-`ALL` version.
|
|
|
|
## Pieces
|
|
- **`nosignal-sudo-toggle`** → `/usr/local/bin` — `enable` / `disable` / `status`.
|
|
- **`nosignal-sudoless-boot-clean.service`** (enabled) — removes the drop-in on
|
|
every boot (reboot safety net; see below).
|
|
- **`SudoToggleRow.qml`** → `nexus/common/` (untracked, survives upgrades).
|
|
- **`patch-servicespage.sh`** — inserts the toggle into `ServicesPage.qml`
|
|
(re-applied by the caelestia-shell pacman hook, like the Additions/Updates patches).
|
|
|
|
## How it works
|
|
- **enable** (root; you authenticate ONCE): validates a drop-in with
|
|
`visudo -cf` *before* installing it (a broken sudoers never reaches
|
|
`/etc/sudoers.d`), writes `/etc/sudoers.d/01-nosignal-sudoless`
|
|
(`<user> ALL=(ALL:ALL) NOPASSWD: ALL`, mode 0440), stamps
|
|
`/run/nosignal-sudoless.stamp` (world-readable, for `status`), and arms a
|
|
root-owned transient timer: `systemd-run --on-active=15min … disable`.
|
|
- **disable**: cancels the timer, removes the drop-in + stamp. Inside the window
|
|
`sudo -n` runs it without a prompt; the panel's "off" uses exactly that.
|
|
- **status**: reads only the `/run` stamp → no root, so the toggle can poll it
|
|
every 5 s and show minutes remaining.
|
|
|
|
## Safety
|
|
- `visudo -cf` validation before install — never installs a malformed sudoers.
|
|
- Auto-revert after 15 min via a root systemd timer (no password needed).
|
|
- **Reboot net:** transient timers don't survive a reboot but the `/etc`
|
|
drop-in would — so `nosignal-sudoless-boot-clean.service` removes it on every
|
|
boot. A reboot always ends the sudoless session.
|
|
- Full `NOPASSWD: ALL` is broad **by design** (the requested "run sudoless"),
|
|
with the 15-min window + reboot net as the bound. If you want it narrower,
|
|
change the drop-in body in `nosignal-sudo-toggle` (e.g. limit to
|
|
`/usr/bin/systemctl, /usr/bin/pacman`).
|
|
|
|
## Install (root)
|
|
```
|
|
sudo sh ~/.local/share/nosignal/sudo-timed-nopasswd/install-sudo-timed-nopasswd.sh
|
|
```
|
|
Then reload caelestia (or log out/in) so the new toggle/QML loads.
|
|
|
|
## Use
|
|
- Settings → Services → **Passwordless sudo (15 min)**: on opens a small
|
|
floating terminal for your password (once); off reverts immediately.
|
|
- Or terminal: `sudo nosignal-sudo-toggle enable` / `disable`,
|
|
`nosignal-sudo-toggle status`.
|
|
|
|
## Auto-revert
|
|
The 15-min `systemd-run` timer fires on schedule to revert the drop-in.
|
|
`disable` removes the drop-in/stamp **first**, then touches units, and
|
|
`cancel_timer` stops **only the `.timer`**, never the `.service` — this avoids
|
|
the revert service stopping itself (getting SIGTERM'd) before the `rm` runs.
|
|
|
|
`disable` also clears the user's cached sudo **timestamp**
|
|
(`/run/sudo/ts/<user>`) — sudo caches a ticket ~15 min independently of the
|
|
drop-in, so without this a sudo run just before revert would stay passwordless
|
|
past the window.
|
|
|
|
## QML toggle
|
|
The Settings → Services row toggles sudoless mode. Toggle ON → floating
|
|
terminal → password → drop-in installed, 15-min timer armed, status `active 15`.
|
|
Toggle OFF → immediate revert: drop-in + stamp removed, timer disarmed, sudo
|
|
cache cleared, `sudo` prompts again.
|
|
|
|
## Files
|
|
- `nosignal-sudo-toggle`, `nosignal-sudoless-boot-clean.service`,
|
|
`install-sudo-timed-nopasswd.sh`, `SudoToggleRow.qml`,
|
|
`patch-servicespage.sh`, `migrations/1781456400-sudo-timed-nopasswd.sh`.
|