67e26be2d9
The public tree and its history contain only the listed paths. Earlier projection history remains preserved internally. Source-Sha: 913fde029b935671833254797f0f20f1eb9fabba Policy-Sha: 913fde029b935671833254797f0f20f1eb9fabba Tree-Digest: 180ae530c1058a2a5c89837bdce2d323ae83e669e38590ca72e75b8d92b7262f
8 lines
641 B
Text
8 lines
641 B
Text
# RedFlag Agent sudo grants — capability-token execution only.
|
|
# Package-manager commands never appear here: discovery runs unprivileged with
|
|
# lists/cache/log redirected to an agent-writable temp dir.
|
|
# Local mint/envelope authority is a separate file
|
|
# (/etc/sudoers.d/redflag-agent-mint) written only by the standalone
|
|
# provisioning script, never by this package's static configuration.
|
|
Defaults:redflag-agent !lecture
|
|
redflag-agent ALL=(root) NOPASSWD: /usr/bin/systemd-run --wait --property=ProtectSystem=no -- /usr/local/bin/redflag-helper --token-file /var/lib/redflag/agent/tokens/* --result-file /var/lib/redflag/agent/results/*
|