lab/archlinux
Watch
1
0
Fork
You've already forked archlinux
 0
mirror of https://git.myvelabs.com/lab/archlinux.git synced 2026-08-16 12:54:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

Switch /dev/random to urandom and sudo to sudo-rs

Browse source
This commit is contained in:
myve 2026-08-07 10:30:45 +00:00
commit 462624a07e
2 changed files with 41 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

63
functions/chroot
View file

@ -170,33 +170,44 @@ unset userpass userpass2
# Disable root account
passwd -l root >/dev/null 2>&1
# Sudoers
install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS
Defaults passwd_timeout=0
Defaults timestamp_type=global
Defaults insults
# sudo-rs sudoers
# install -m 0440 /dev/stdin /etc/sudoers.d/01-DEFAULTS <<- DEFAULTS
# Defaults passwd_timeout=0
# Defaults timestamp_type=global
# Defaults insults
# DEFAULTS
# install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
# Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
# Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
# Cmnd_Alias BTRFS = /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
# Cmnd_Alias QEMU = /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
# Cmnd_Alias FAIL2BAN = /usr/bin/fail2ban-client
# Cmnd_Alias ARCHISO = /opt/local/bin/mkairgap, /opt/local/bin/mkiso
# Cmnd_Alias PACMAN = /usr/bin/pacman -Sy
# Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
# Cmnd_Alias MISC = /usr/bin/rsync
# COMMANDS
# install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
# %wheel ALL=(ALL:ALL) ALL
# %wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
# WHEEL
# install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
# Defaults:${username} !authenticate
# NOPASSWD
cat >/etc/pam.d/sudo <<- 'sudo'
#%PAM-1.0
auth include system-auth
account include system-auth
session include system-auth
sudo
ln -s -f /etc/pam.d/sudo /etc/pam.d/sudo-i
install -m 0440 /dev/stdin /etc/sudoers-rs <<- 'DEFAULTS'
Defaults!/usr/bin/visudo env_keep += "SUDO_EDITOR EDITOR VISUAL"
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/bin"
root ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) NOPASSWD: ALL
DEFAULTS
install -m 0440 /dev/stdin /etc/sudoers.d/02-COMMANDS <<- COMMANDS
Cmnd_Alias POWER = /usr/bin/poweroff, /usr/bin/reboot
Cmnd_Alias ZFS = /usr/bin/zfs, /usr/bin/zpool
Cmnd_Alias BTRFS = /usr/bin/btrfs, /usr/bin/timeshift, /usr/bin/timeshift-gtk, /usr/bin/timeshift-launcher
Cmnd_Alias QEMU = /usr/bin/virsh, /usr/bin/qemu-system-x86_64, /usr/bin/virt-install
Cmnd_Alias FAIL2BAN = /usr/bin/fail2ban-client
Cmnd_Alias ARCHISO = /opt/local/bin/mkairgap, /opt/local/bin/mkiso
Cmnd_Alias PACMAN = /usr/bin/pacman -Sy
Cmnd_Alias IPTABLES = /usr/bin/iptables, /usr/bin/iptables-save
Cmnd_Alias MISC = /usr/bin/rsync
COMMANDS
install -m 0440 /dev/stdin /etc/sudoers.d/03-WHEEL <<- WHEEL
%wheel ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) NOPASSWD: POWER, ZFS, BTRFS, QEMU, FAIL2BAN, ARCHISO, PACMAN, IPTABLES, MISC
WHEEL
install -m 0440 /dev/stdin /etc/sudoers.d/.zz-NOPASSWD <<- NOPASSWD
Defaults:${username} !authenticate
NOPASSWD
ln -s -f /usr/bin/sudo-rs /usr/local/bin/sudo
case ${filesystem} in
zfs)