mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-08-21 18:39:06 +00:00
ChuckBuilds
500cfbc9f4
Review follow-up. Two findings, both right, and the first is a hole I opened myself. `NOPASSWD: iptables *` is a root shell for the web user by another name. `iptables --modprobe=/path/to/anything` runs that path as root, so a wildcard grant on iptables escalates rather than restricts. I added that rule while fixing a permissions gap, which is a worse outcome than the gap. It is gone, and a test now fails on any trailing-wildcard grant to a tool that can execute another program -- iptables, nft, tcpdump, find, awk, sed, perl, python, env. The other finding: checking only the binary made the coverage test far weaker than it looked. With `sysctl` present anywhere in the allow-list, deleting the `net.ipv4.ip_forward=0` grant still passed -- and the portal would then be unable to restore forwarding on teardown. Each required command is now matched in full, and each is mutation-checked individually, including that exact single-line case. Scope pulled in deliberately. The first version of this test tried to assert that *every* sudo call in the codebase is granted. Run honestly, it showed the portal also runs iptables, nft, `ip addr`, `ip link` and `cp` with arguments built at runtime -- an interface name, a port. Those cannot be granted safely in a sudoers file: the rule needs a trailing wildcard, and that is the escalation above. Closing that half needs a privileged helper that builds the rules itself and takes only an interface and a port, granted the way safe_plugin_rm.sh already is. That is a design decision, not a one-line grant, so the test now pins the four commands this change actually grants and the docstring says plainly what it does not cover. Better a narrow test that is true than a broad one that is not.
Installation Scripts
This directory contains scripts for installing and configuring the LEDMatrix system.
Scripts
one-shot-install.sh- Single-command installer; clones the repo, checks prerequisites, then runsfirst_time_install.sh. Invoked viacurl ... | bashfrom the project root README.install_service.sh- Installs the main LED Matrix display service (systemd)install_web_service.sh- Installs the web interface service (systemd)install_wifi_monitor.sh- Installs the WiFi monitor daemon servicesetup_cache.sh- Sets up persistent cache directory with proper permissionsconfigure_web_sudo.sh- Configures passwordless sudo access for web interface actionsconfigure_wifi_permissions.sh- Grants theledmatrixuser the WiFi management permissions needed by the web interface and the WiFi monitor servicemigrate_config.sh- Migrates configuration files to new formats (if needed)debug_install.sh- Diagnostic helper used when an install fails; collects environment info and recent logs
Usage
These scripts are typically called by first_time_install.sh in the
project root (which itself is invoked by one-shot-install.sh), but
can also be run individually if needed.
Note: Most installation scripts require sudo privileges to install systemd services and configure system settings.