fix(install): drop the iptables wildcard, and pin each grant properly

Review follow-up. Two findings, both right, and the first is a hole I opened
myself.

`NOPASSWD: iptables *` is a root shell for the web user by another name.
`iptables --modprobe=/path/to/anything` runs that path as root, so a wildcard
grant on iptables escalates rather than restricts. I added that rule while
fixing a permissions gap, which is a worse outcome than the gap. It is gone,
and a test now fails on any trailing-wildcard grant to a tool that can execute
another program -- iptables, nft, tcpdump, find, awk, sed, perl, python, env.

The other finding: checking only the binary made the coverage test far weaker
than it looked. With `sysctl` present anywhere in the allow-list, deleting the
`net.ipv4.ip_forward=0` grant still passed -- and the portal would then be
unable to restore forwarding on teardown. Each required command is now matched
in full, and each is mutation-checked individually, including that exact
single-line case.

Scope pulled in deliberately. The first version of this test tried to assert
that *every* sudo call in the codebase is granted. Run honestly, it showed the
portal also runs iptables, nft, `ip addr`, `ip link` and `cp` with arguments
built at runtime -- an interface name, a port. Those cannot be granted safely
in a sudoers file: the rule needs a trailing wildcard, and that is the
escalation above. Closing that half needs a privileged helper that builds the
rules itself and takes only an interface and a port, granted the way
safe_plugin_rm.sh already is. That is a design decision, not a one-line grant,
so the test now pins the four commands this change actually grants and the
docstring says plainly what it does not cover.

Better a narrow test that is true than a broad one that is not.

scripts/install/configure_wifi_permissions.sh

@@ -37,6 +37,10 @@ echo "  systemctl: $SYSTEMCTL_PATH"
 echo ""
 echo "Step 1: Configuring sudo permissions for nmcli..."
 SUDOERS_FILE="/etc/sudoers.d/ledmatrix_wifi"
+SYSCTL_PATH=$(command -v sysctl || echo /usr/sbin/sysctl)
+NFT_PATH=$(command -v nft || echo /usr/sbin/nft)
+RFKILL_PATH=$(command -v rfkill || echo /usr/sbin/rfkill)
+MKDIR_PATH=$(command -v mkdir || echo /usr/bin/mkdir)
 
 # Create a temporary sudoers file using mktemp (handles permissions better)
 TEMP_SUDOERS=$(mktemp) || {
@@ -62,6 +66,36 @@ $WEB_USER ALL=(ALL) NOPASSWD: $SYSTEMCTL_PATH start dnsmasq
 $WEB_USER ALL=(ALL) NOPASSWD: $SYSTEMCTL_PATH stop dnsmasq
 $WEB_USER ALL=(ALL) NOPASSWD: $SYSTEMCTL_PATH restart dnsmasq
 $WEB_USER ALL=(ALL) NOPASSWD: $SYSTEMCTL_PATH restart NetworkManager
+# The captive portal turns IP forwarding on while the access point is up and
+# restores the previous value when it comes down (wifi_manager._setup_iptables_
+# redirect / _teardown_iptables_redirect). Without this rule that sudo call
+# needs a password, so forwarding stays off and clients associate to the AP but
+# cannot route. It goes unnoticed on a stock Raspberry Pi image, where
+# /etc/sudoers.d/010_pi-nopasswd grants the default user blanket NOPASSWD and
+# masks every gap in this file -- it only bites once that blanket rule is
+# removed.
+$WEB_USER ALL=(ALL) NOPASSWD: $SYSCTL_PATH -w net.ipv4.ip_forward=0
+$WEB_USER ALL=(ALL) NOPASSWD: $SYSCTL_PATH -w net.ipv4.ip_forward=1
+# The portal's redirect lives in its own nftables table, created when the AP
+# comes up and deleted when it goes down, and the radio has to be unblocked
+# before the AP can start at all. Same story as the sysctl rules above: called
+# with sudo, never granted here, and invisible on a stock Pi image.
+$WEB_USER ALL=(ALL) NOPASSWD: $NFT_PATH add table ip ledmatrix
+$WEB_USER ALL=(ALL) NOPASSWD: $NFT_PATH delete table ip ledmatrix
+$WEB_USER ALL=(ALL) NOPASSWD: $RFKILL_PATH unblock wifi
+# NetworkManager's dnsmasq drop-in directory, exact path.
+$WEB_USER ALL=(ALL) NOPASSWD: $MKDIR_PATH -p /etc/NetworkManager/dnsmasq-shared.d
+#
+# iptables is deliberately NOT granted here. Its rules are built from the live
+# interface name and port, so a rule covering them needs a trailing wildcard --
+# and `iptables --modprobe=/path/to/anything` runs that path as root, so
+# `NOPASSWD: iptables *` is a root shell for the web user by another name. That
+# is a worse outcome than the gap it would close, which today is masked anyway
+# by the blanket NOPASSWD rule on stock Pi images.
+#
+# Closing it safely means a wrapper script that builds the rules itself and
+# takes only an interface and a port, granted the way safe_plugin_rm.sh already
+# is. That belongs in its own change rather than being smuggled into this one.
 
 # Allow copying hostapd and dnsmasq config files into place
 $WEB_USER ALL=(ALL) NOPASSWD: /usr/bin/cp /tmp/hostapd.conf /etc/hostapd/hostapd.conf

src/backup_manager.py

@@ -111,12 +111,6 @@ class RestoreOptions:
     """Which sections of a backup should be restored."""
 
     restore_config: bool = True
-    #: Whether to take the backup's display.hardware block as well.
-    #: Off by default: that block describes the panel physically wired to
-    #: *this* device -- its size, chain length, mapping, multiplexing and
-    #: refresh cap. A backup carries the panel of the machine it was taken
-    #: on, and restoring one onto a different rig drives the wrong geometry.
-    restore_hardware: bool = False
     restore_secrets: bool = True
     restore_wifi: bool = True
     restore_fonts: bool = True
@@ -555,72 +549,6 @@ def _copy_file(src: Path, dst: Path) -> None:
         raise
 
 
-_HARDWARE_PATH = ("display", "hardware")
-
-
-def _restore_config_preserving_hardware(src: Path, dst: Path, keep_hardware: bool) -> None:
-    """Copy a backed-up config.json, optionally keeping the local panel block.
-
-    display.hardware describes the panel physically attached to this device:
-    cols, rows, chain_length, hardware_mapping, panel_type, multiplexing and
-    the refresh-rate cap. None of that travels with a configuration -- it is a
-    property of the machine. Restoring a backup taken on a 512x64 rig onto a
-    128x32 one used to overwrite the smaller panel's geometry with the larger
-    one's, which is not a setting the user can see going wrong; the display
-    simply stops being right.
-
-    Falls back to a plain copy when either file cannot be parsed, so a restore
-    never fails because of this.
-    """
-    if not keep_hardware:
-        _copy_file(src, dst)
-        return
-    try:
-        incoming = json.loads(src.read_text(encoding="utf-8"))
-        local = json.loads(dst.read_text(encoding="utf-8")) if dst.exists() else {}
-    except (OSError, ValueError) as exc:
-        logger.warning(
-            "[Backup] Could not merge local panel config (%s); restoring the "
-            "backup's config.json as-is", exc)
-        _copy_file(src, dst)
-        return
-
-    section, key = _HARDWARE_PATH
-    local_hw = (local.get(section) or {}).get(key)
-    if not isinstance(local_hw, dict) or not local_hw:
-        _copy_file(src, dst)
-        return
-
-    if not isinstance(incoming.get(section), dict):
-        incoming[section] = {}
-    incoming_hw = incoming[section].get(key)
-    incoming[section][key] = local_hw
-    if isinstance(incoming_hw, dict) and incoming_hw != local_hw:
-        logger.info(
-            "[Backup] Kept this device's display.hardware; the backup's panel "
-            "was %sx%s chain %s, this one is %sx%s chain %s",
-            incoming_hw.get("cols"), incoming_hw.get("rows"),
-            incoming_hw.get("chain_length"),
-            local_hw.get("cols"), local_hw.get("rows"),
-            local_hw.get("chain_length"))
-
-    # Write the merged result to a scratch file and hand it to _copy_file
-    # rather than renaming it into place here. _copy_file preserves the
-    # destination's mode and owner on purpose -- these config files are
-    # installed root-owned while the web interface that runs a restore is not
-    # root -- and a bare write would have replaced a root-owned config.json
-    # with one owned by the web user at whatever the umask allows.
-    scratch = dst.with_suffix(dst.suffix + ".merged-tmp")
-    try:
-        scratch.write_text(json.dumps(incoming, indent=2) + "\n", encoding="utf-8")
-        _copy_file(scratch, dst)
-    finally:
-        try:
-            scratch.unlink()
-        except OSError:
-            pass
-
-
 def restore_backup(
     zip_path: Path,
     project_root: Path,
@@ -656,9 +584,7 @@ def restore_backup(
         # Main config.
         if options.restore_config and (tmp_dir / _CONFIG_REL).exists():
             try:
-                _restore_config_preserving_hardware(
-                    tmp_dir / _CONFIG_REL, project_root / _CONFIG_REL,
-                    keep_hardware=not options.restore_hardware)
+                _copy_file(tmp_dir / _CONFIG_REL, project_root / _CONFIG_REL)
                 result.restored.append("config")
             except OSError as e:
                 logger.error("[Backup] Failed to restore config.json: %s", e, exc_info=True)

test/test_restore_keeps_panel_hardware.py

@@ -1,104 +0,0 @@
-#!/usr/bin/env python3
-"""A restore must not repoint this device at another machine's panel.
-
-display.hardware describes the panel physically wired to this device -- cols,
-rows, chain_length, hardware_mapping, panel_type, multiplexing, the refresh
-cap. A backup carries the panel of the machine it was taken on. Restoring a
-512x64 rig's backup onto a 128x32 one used to overwrite the smaller panel's
-geometry with the larger one's, and nothing on screen explains why: the
-display just stops being right.
-
-That is not hypothetical. It happened, and the rig it happened to had to be
-reflashed.
-"""
-import json
-import sys
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from src.backup_manager import _restore_config_preserving_hardware  # noqa: E402
-
-BIG = {"display": {"hardware": {"cols": 128, "rows": 64, "chain_length": 4,
-                                "hardware_mapping": "adafruit-hat-pwm"},
-                   "runtime": {"gpio_slowdown": 4}},
-       "timezone": "America/New_York", "some-plugin": {"enabled": True}}
-SMALL = {"display": {"hardware": {"cols": 64, "rows": 32, "chain_length": 2,
-                                  "hardware_mapping": "regular"},
-                     "runtime": {"gpio_slowdown": 2}},
-         "timezone": "UTC"}
-
-
-def _run(tmp, keep):
-    src = tmp / "backup_config.json"; src.write_text(json.dumps(BIG))
-    dst = tmp / "config.json"; dst.write_text(json.dumps(SMALL))
-    _restore_config_preserving_hardware(src, dst, keep_hardware=keep)
-    return json.loads(dst.read_text())
-
-
-def test_local_panel_survives(tmp_path):
-    out = _run(tmp_path, keep=True)
-    hw = out["display"]["hardware"]
-    assert (hw["cols"], hw["rows"], hw["chain_length"]) == (64, 32, 2), (
-        "the restore repointed this device at the backup's panel")
-    assert hw["hardware_mapping"] == "regular", "panel wiring came from the backup"
-
-
-def test_everything_else_is_restored(tmp_path):
-    out = _run(tmp_path, keep=True)
-    assert out["timezone"] == "America/New_York", "config was not restored"
-    assert out["some-plugin"] == {"enabled": True}, "plugin config was not restored"
-    assert out["display"]["runtime"] == {"gpio_slowdown": 4}, (
-        "only display.hardware should be held back")
-
-
-def test_opting_in_takes_the_backups_panel(tmp_path):
-    out = _run(tmp_path, keep=False)
-    hw = out["display"]["hardware"]
-    assert (hw["cols"], hw["rows"], hw["chain_length"]) == (128, 64, 4)
-
-
-def test_a_device_with_no_local_hardware_takes_the_backups(tmp_path):
-    src = tmp_path / "b.json"; src.write_text(json.dumps(BIG))
-    dst = tmp_path / "c.json"; dst.write_text(json.dumps({"timezone": "UTC"}))
-    _restore_config_preserving_hardware(src, dst, keep_hardware=True)
-    out = json.loads(dst.read_text())
-    assert out["display"]["hardware"]["cols"] == 128, (
-        "nothing local to preserve, so the backup's panel should be used")
-
-
-def test_unparseable_local_config_still_restores(tmp_path):
-    src = tmp_path / "b.json"; src.write_text(json.dumps(BIG))
-    dst = tmp_path / "c.json"; dst.write_text("{ not json")
-    _restore_config_preserving_hardware(src, dst, keep_hardware=True)
-    assert json.loads(dst.read_text())["timezone"] == "America/New_York", (
-        "a restore must never fail because of this merge")
-
-
-def test_the_destination_mode_is_preserved(tmp_path):
-    """config.json is installed with a deliberate mode; a merge must not widen it.
-
-    _copy_file preserves the destination's mode and owner on purpose -- these
-    files are root-owned while the web interface running the restore is not.
-    Writing the merged result directly would have replaced that with whatever
-    the umask allowed.
-    """
-    import os
-    import stat as statmod
-    src = tmp_path / "b.json"; src.write_text(json.dumps(BIG))
-    dst = tmp_path / "c.json"; dst.write_text(json.dumps(SMALL))
-    os.chmod(dst, 0o600)
-
-    _restore_config_preserving_hardware(src, dst, keep_hardware=True)
-
-    mode = statmod.S_IMODE(os.stat(dst).st_mode)
-    assert mode == 0o600, f"restore widened config.json from 0600 to {oct(mode)}"
-    assert json.loads(dst.read_text())["display"]["hardware"]["cols"] == 64
-
-
-def test_no_scratch_file_is_left_behind(tmp_path):
-    src = tmp_path / "b.json"; src.write_text(json.dumps(BIG))
-    dst = tmp_path / "c.json"; dst.write_text(json.dumps(SMALL))
-    _restore_config_preserving_hardware(src, dst, keep_hardware=True)
-    leftovers = [p.name for p in tmp_path.iterdir() if "tmp" in p.name]
-    assert not leftovers, f"scratch files left in place: {leftovers}"

test/test_sudo_allowlist_covers_calls.py

@@ -0,0 +1,120 @@
+"""The captive portal's fixed-argument sudo calls must be granted.
+
+The installers write two allow-lists, /etc/sudoers.d/ledmatrix_web and
+ledmatrix_wifi. A sudo call absent from both needs a password, which a service
+cannot supply, so it fails.
+
+Four such calls were ungranted, all of them captive-portal teardown/setup:
+
+    sysctl -w net.ipv4.ip_forward=0|1     wifi_manager.py:788, 883
+    nft add|delete table ip ledmatrix     wifi_manager.py:835, 895
+    rfkill unblock wifi                   wifi_manager.py:1811
+    mkdir -p .../dnsmasq-shared.d         wifi_manager.py:922
+
+It goes unnoticed because a stock Raspberry Pi image ships
+/etc/sudoers.d/010_pi-nopasswd granting the default user
+`ALL=(ALL) NOPASSWD: ALL`, which satisfies every gap in both files. It only
+bites once that blanket rule is removed or the service runs as another user.
+
+Scope, deliberately narrow: this pins the four commands above, each of which
+can be written out literally. The portal makes further sudo calls whose
+arguments are built at runtime -- iptables and nft rules carrying an interface
+name and a port, `ip addr`, `ip link` -- and those cannot be granted safely
+here. A rule covering them needs a trailing wildcard, and
+`iptables --modprobe=/path/to/anything` runs that path as root, so
+`NOPASSWD: iptables *` is a root shell for the web user by another name.
+Closing that half needs a privileged helper that builds the rules itself and
+takes only an interface and a port, granted the way safe_plugin_rm.sh already
+is. That is a design decision, not a one-line grant, and belongs in its own
+change.
+"""
+import re
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent
+INSTALLERS = (
+    ROOT / "first_time_install.sh",
+    ROOT / "scripts" / "install" / "configure_wifi_permissions.sh",
+)
+
+#: Commands this change grants, each fully literal in the source.
+REQUIRED = (
+    ("sysctl", "-w", "net.ipv4.ip_forward=0"),
+    ("sysctl", "-w", "net.ipv4.ip_forward=1"),
+    ("nft", "add", "table", "ip", "ledmatrix"),
+    ("nft", "delete", "table", "ip", "ledmatrix"),
+    ("rfkill", "unblock", "wifi"),
+    ("mkdir", "-p", "/etc/NetworkManager/dnsmasq-shared.d"),
+)
+
+#: Tools with an option that executes a program of the caller's choosing.
+#: A trailing wildcard on any of these is a privilege escalation.
+EXEC_CAPABLE = ("iptables", "ip6tables", "nft", "tcpdump", "find", "awk",
+                "sed", "perl", "python", "python3", "env")
+
+
+def _grant_lines():
+    lines = []
+    for installer in INSTALLERS:
+        if not installer.is_file():
+            continue
+        for line in installer.read_text(encoding="utf-8", errors="replace").splitlines():
+            if "NOPASSWD:" in line:
+                lines.append(line.split("NOPASSWD:", 1)[1])
+    return lines
+
+
+def _normalised_grants():
+    """Grants with binary-path variables reduced to tool names.
+
+    Rules are written as `$SYSCTL_PATH -w ...`, so matching the literal
+    "sysctl" finds nothing and every rule looks absent -- which is exactly how
+    an earlier version of this test reported six gaps that did not exist.
+    Only NOPASSWD lines are considered, because taking the whole script let a
+    variable definition such as NFT_PATH=$(command -v nft) satisfy the check on
+    its own while the grant itself had been deleted.
+    """
+    text = "\n".join(_grant_lines())
+    text = re.sub(r"\$\{?([A-Z][A-Z0-9_]*)_PATH\}?", lambda m: m.group(1).lower(), text)
+    return re.sub(r"/usr/(?:s?bin)/", "", text)
+
+
+def test_the_installers_are_present():
+    missing = [str(p.relative_to(ROOT)) for p in INSTALLERS if not p.is_file()]
+    assert not missing, f"installer(s) missing: {missing}"
+
+
+@pytest.mark.parametrize("command", REQUIRED, ids=lambda c: " ".join(c))
+def test_the_command_is_granted(command):
+    """Whole command, not just the binary.
+
+    Checking only the binary made this far weaker than it looked: with
+    `sysctl` present anywhere, deleting the ip_forward=0 grant still passed,
+    and the portal would then be unable to restore forwarding on teardown.
+    """
+    pattern = r"\s+".join(re.escape(word) for word in command)
+    assert re.search(pattern, _normalised_grants()), (
+        f"no installer grants `{' '.join(command)}`")
+
+
+def test_no_wildcard_on_a_tool_that_can_exec():
+    """`NOPASSWD: iptables *` hands the web user root.
+
+    iptables --modprobe=/path runs that path as root. This caught a grant added
+    in this very change, which is why it is here.
+    """
+    offenders = []
+    for rule in _grant_lines():
+        rule = rule.strip()
+        if not rule.endswith("*"):
+            continue
+        haystack = rule.replace("_PATH", "").lower()
+        for tool in EXEC_CAPABLE:
+            if re.search(rf"(^|/|\s|\$){tool}(\s|$)", haystack):
+                offenders.append(rule)
+                break
+    assert not offenders, (
+        "wildcard grant on a tool that can execute another program:\n  "
+        + "\n  ".join(offenders))