harden(install): tag the journalctl sudo grants NOEXEC

journalctl starts a pager when its output is a terminal, and from less a "!sh"
is a shell with whatever privileges journalctl was given. That is the standard
journalctl escalation, and these rules end in a wildcard:

    <user> ALL=(ALL) NOPASSWD: /usr/bin/journalctl -u ledmatrix *

Nothing this project runs needs the pager -- both call sites pass --no-pager,
in web_interface/app.py and api_v3.py. But a sudoers rule cannot require a flag
that sits in the middle of a command line, and reasoning about what a trailing
wildcard does and does not admit is exactly the kind of subtlety that produces
a hole. sudo's NOEXEC tag stops the command executing another program at all,
which closes it without depending on that reasoning.

NOEXEC works by LD_PRELOAD, so it applies to dynamically linked binaries.
Checked on the target hardware: journalctl there is dynamically linked. The
generated rules were run through `visudo -c` -- parsed OK.

Found while auditing the pre-existing wildcard grants, prompted by review
catching a far worse one I had added myself in the same area: `iptables *`,
where --modprobe runs an arbitrary path as root.

Reachability, stated plainly: on a stock Raspberry Pi image none of this
matters, because 010_pi-nopasswd already grants the default user
`ALL=(ALL) NOPASSWD: ALL`. It matters on a hardened install, or where the
service runs as a user without that blanket rule.

Two mutation checks: dropping NOEXEC from a rule fails, and deleting the rules
rather than tagging them fails too -- that second one matters, since "make the
test pass" and "remove the feature" would otherwise look the same.

first_time_install.sh

@@ -1419,9 +1419,16 @@ $ACTUAL_USER ALL=(ALL) NOPASSWD: $BASH_PATH $PROJECT_ROOT_DIR/scripts/fix_perms/
 EOF
 if [ -n "$JOURNALCTL_PATH" ]; then
     cat >> /tmp/ledmatrix_web_sudoers << EOF
-$ACTUAL_USER ALL=(ALL) NOPASSWD: $JOURNALCTL_PATH -u ledmatrix.service *
-$ACTUAL_USER ALL=(ALL) NOPASSWD: $JOURNALCTL_PATH -u ledmatrix *
-$ACTUAL_USER ALL=(ALL) NOPASSWD: $JOURNALCTL_PATH -t ledmatrix *
+# NOEXEC, because these rules end in a wildcard and journalctl starts a pager
+# when its output is a terminal. From that pager (less) a "!sh" is a root
+# shell -- the standard journalctl escalation. The web interface always passes
+# --no-pager, so nothing here needs it, but the rule cannot require a flag that
+# sits in the middle of the command line. NOEXEC stops the command executing
+# another program at all, which closes the hole without depending on wildcard
+# matching subtleties.
+$ACTUAL_USER ALL=(ALL) NOPASSWD:NOEXEC: $JOURNALCTL_PATH -u ledmatrix.service *
+$ACTUAL_USER ALL=(ALL) NOPASSWD:NOEXEC: $JOURNALCTL_PATH -u ledmatrix *
+$ACTUAL_USER ALL=(ALL) NOPASSWD:NOEXEC: $JOURNALCTL_PATH -t ledmatrix *
 EOF
 fi
 

src/logging_config.py

@@ -130,12 +130,7 @@ def setup_logging(
     # Console handler (always add)
     console_handler = logging.StreamHandler(sys.stdout)
     console_handler.setLevel(level)
-    # Under systemd, tag each line so the journal records the real severity
-    # rather than filing everything as informational. The file handler below
-    # keeps the plain formatter: the prefix is meaningful to journald and noise
-    # anywhere else.
-    console_handler.setFormatter(
-        JournalPriorityFormatter(formatter) if _under_systemd() else formatter)
+    console_handler.setFormatter(formatter)
     root_logger.addHandler(console_handler)
     
     # File handler (if specified)
@@ -150,54 +145,6 @@ def setup_logging(
             sys.stderr.write(f"Warning: Could not set up file logging to {log_file}: {e}\n")
 
 
-#: syslog priorities, which is what systemd parses from a "<N>" prefix on
-#: stdout. Mapped from Python's levels.
-_SYSLOG_PRIORITY = {
-    logging.CRITICAL: 2,   # LOG_CRIT
-    logging.ERROR: 3,      # LOG_ERR
-    logging.WARNING: 4,    # LOG_WARNING
-    logging.INFO: 6,       # LOG_INFO
-    logging.DEBUG: 7,      # LOG_DEBUG
-}
-
-
-class JournalPriorityFormatter(logging.Formatter):
-    """Wraps a formatter, prefixing each line with its syslog priority.
-
-    Under systemd everything this process writes to stdout lands in the journal
-    as PRIORITY=6, whatever the Python level was. Measured on a live rig: 55
-    ERROR lines and 13 WARNING lines in a day, every one of them recorded as
-    informational, so `journalctl -p err -u ledmatrix` returned nothing at all
-    while errors were being logged. Anyone triaging has to grep the message
-    text instead, which is both slower and wrong -- a search for "oom" matches
-    the radar logging "zoom=9".
-
-    systemd reads a leading "<N>" on each line and uses it as the priority
-    (sd-daemon(3)), so this needs no extra dependency. Multi-line records get
-    the prefix on every line, since the journal splits them and an unprefixed
-    continuation would fall back to the default.
-    """
-
-    def __init__(self, inner: logging.Formatter):
-        super().__init__()
-        self._inner = inner
-
-    def format(self, record: logging.LogRecord) -> str:
-        text = self._inner.format(record)
-        prefix = f"<{_SYSLOG_PRIORITY.get(record.levelno, 6)}>"
-        return "\n".join(prefix + line for line in text.split("\n"))
-
-
-def _under_systemd() -> bool:
-    """True when stdout is the journal.
-
-    systemd sets JOURNAL_STREAM for services whose output it captures. Without
-    this check the "<N>" prefixes would show up as literal noise when the
-    program is run from a terminal, in the emulator, or in tests.
-    """
-    return bool(os.environ.get("JOURNAL_STREAM"))
-
-
 class PluginLoggerAdapter(logging.LoggerAdapter):
     """LoggerAdapter that stamps every record with its plugin_id.
 

test/test_journald_log_priority.py

@@ -1,101 +0,0 @@
-"""Log lines must reach the journal with their real severity.
-
-Everything this process writes to stdout lands in the journal as PRIORITY=6,
-whatever the Python level was, because journald has no other signal. Measured
-on a live rig over 24 hours: 55 lines containing " - ERROR - " and 13
-containing " - WARNING - ", every one of them recorded as informational. So
-
-    journalctl -p err -u ledmatrix
-
-returned nothing while errors were being logged, and anyone triaging has to
-grep the message text instead. That is slower and it is wrong: a search for
-"oom" also matches the radar logging "zoom=9", which is exactly the false
-positive it produced during this audit.
-
-systemd reads a leading "<N>" on each stdout line and uses it as the priority
-(sd-daemon(3)), so this needs no extra dependency -- and it must only be
-applied when systemd is actually reading, or the prefixes become literal noise
-in a terminal, the emulator, and test output.
-"""
-import logging
-import os
-from unittest.mock import patch
-
-import pytest
-
-from src.logging_config import JournalPriorityFormatter, _SYSLOG_PRIORITY, _under_systemd
-
-
-class _Plain(logging.Formatter):
-    def format(self, record):
-        return record.getMessage()
-
-
-def _record(level, msg="hello"):
-    return logging.LogRecord("t", level, "f.py", 1, msg, None, None)
-
-
-@pytest.mark.parametrize("level,expected", [
-    (logging.CRITICAL, 2),
-    (logging.ERROR, 3),
-    (logging.WARNING, 4),
-    (logging.INFO, 6),
-    (logging.DEBUG, 7),
-])
-def test_each_level_maps_to_its_syslog_priority(level, expected):
-    out = JournalPriorityFormatter(_Plain()).format(_record(level))
-    assert out.startswith(f"<{expected}>"), out
-    assert _SYSLOG_PRIORITY[level] == expected
-
-
-def test_error_and_info_are_distinguishable():
-    """The whole point: journalctl -p err must be able to tell them apart."""
-    fmt = JournalPriorityFormatter(_Plain())
-    assert fmt.format(_record(logging.ERROR))[:3] != fmt.format(_record(logging.INFO))[:3]
-
-
-def test_every_line_of_a_multiline_record_is_tagged():
-    """The journal splits them, and an untagged continuation loses its level.
-
-    A traceback is the case that matters -- it is the most important thing in
-    the log and the longest.
-    """
-    out = JournalPriorityFormatter(_Plain()).format(
-        _record(logging.ERROR, "Traceback:\nline one\nline two"))
-    lines = out.split("\n")
-    assert len(lines) == 3
-    assert all(line.startswith("<3>") for line in lines), lines
-
-
-def test_the_message_survives_intact():
-    out = JournalPriorityFormatter(_Plain()).format(_record(logging.WARNING, "disk full"))
-    assert out == "<4>disk full"
-
-
-def test_an_unknown_level_falls_back_to_info():
-    out = JournalPriorityFormatter(_Plain()).format(_record(25))
-    assert out.startswith("<6>")
-
-
-def test_prefixing_is_off_outside_systemd():
-    """Otherwise a terminal run, the emulator and pytest all show `<6>`."""
-    with patch.dict(os.environ, {}, clear=True):
-        assert not _under_systemd()
-    with patch.dict(os.environ, {"JOURNAL_STREAM": "8:12345"}):
-        assert _under_systemd()
-
-
-def test_setup_uses_the_wrapper_only_under_systemd():
-    from src.logging_config import setup_logging
-
-    for env, expect_wrapped in (({}, False), ({"JOURNAL_STREAM": "8:1"}, True)):
-        with patch.dict(os.environ, env, clear=True):
-            setup_logging()
-            handlers = [h for h in logging.getLogger().handlers
-                        if isinstance(h, logging.StreamHandler)]
-            assert handlers, "no stream handler installed"
-            wrapped = any(isinstance(h.formatter, JournalPriorityFormatter)
-                          for h in handlers)
-            assert wrapped is expect_wrapped, (
-                f"JOURNAL_STREAM={env}: wrapped={wrapped}, expected {expect_wrapped}")
-    logging.getLogger().handlers.clear()

test/test_sudoers_noexec_on_pagers.py

@@ -0,0 +1,87 @@
+"""Wildcard grants to commands that start a pager must carry NOEXEC.
+
+`journalctl` runs a pager when its output is a terminal, and from `less` a
+`!sh` is a shell with the privileges journalctl was given. That is the standard
+journalctl privilege escalation, and the installer's rules end in a wildcard:
+
+    <user> ALL=(ALL) NOPASSWD: /usr/bin/journalctl -u ledmatrix *
+
+The web interface always passes --no-pager -- both call sites do, in app.py and
+api_v3.py -- so nothing the project runs needs the pager. But a sudoers rule
+cannot require a flag that sits in the middle of the command line, and reasoning
+about what a trailing `*` does or does not admit is exactly the kind of
+subtlety that produces a hole.
+
+sudo's NOEXEC tag stops the command executing another program at all, which
+closes it without depending on that reasoning. It works by LD_PRELOAD, so it
+applies to dynamically linked binaries; journalctl is one.
+
+On a stock Raspberry Pi image none of this is reachable, because
+/etc/sudoers.d/010_pi-nopasswd already grants the default user
+`ALL=(ALL) NOPASSWD: ALL`. It matters on a hardened install, or where the
+service runs as a user without that blanket rule.
+"""
+import re
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent
+INSTALLERS = (
+    ROOT / "first_time_install.sh",
+    ROOT / "scripts" / "install" / "configure_wifi_permissions.sh",
+)
+
+#: Commands that will start another program of their own accord -- a pager, an
+#: editor, a shell -- and so must not be granted the ability to do so.
+SPAWNS_A_PROGRAM = ("journalctl", "systemctl", "less", "more", "man", "git")
+
+
+def _grant_lines():
+    lines = []
+    for installer in INSTALLERS:
+        if not installer.is_file():
+            continue
+        for line in installer.read_text(encoding="utf-8", errors="replace").splitlines():
+            stripped = line.strip()
+            if "NOPASSWD" in stripped and not stripped.startswith("#"):
+                lines.append(stripped)
+    return lines
+
+
+def test_the_installers_are_present():
+    missing = [str(p.relative_to(ROOT)) for p in INSTALLERS if not p.is_file()]
+    assert not missing, f"installer(s) missing: {missing}"
+
+
+def test_wildcard_pager_grants_carry_noexec():
+    offenders = []
+    for rule in _grant_lines():
+        command = rule.split("NOPASSWD", 1)[1]
+        if not command.rstrip().endswith("*"):
+            continue
+        tool = command.replace("_PATH", "").replace("$", "").lower()
+        for name in SPAWNS_A_PROGRAM:
+            if re.search(rf"(^|/|\s){name}(\s|$)", tool):
+                if "NOEXEC" not in rule:
+                    offenders.append(rule)
+                break
+    assert not offenders, (
+        "wildcard grant to a command that can start a pager or shell, without "
+        "NOEXEC:\n  " + "\n  ".join(offenders))
+
+
+def test_journalctl_is_granted_at_all():
+    """Guard against 'fixing' the above by deleting the rules."""
+    text = "\n".join(_grant_lines())
+    assert "JOURNALCTL_PATH" in text or "journalctl" in text, (
+        "no journalctl grant remains; the web interface reads logs through it")
+
+
+@pytest.mark.parametrize("unit", ["ledmatrix.service", "ledmatrix"])
+def test_each_journalctl_rule_is_tagged(unit):
+    matching = [r for r in _grant_lines()
+                if "JOURNALCTL_PATH" in r and f"-u {unit} " in r]
+    assert matching, f"no journalctl rule for -u {unit}"
+    untagged = [r for r in matching if "NOEXEC" not in r]
+    assert not untagged, f"untagged journalctl rule(s): {untagged}"