mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-08-20 18:09:05 +00:00
ChuckBuilds
61d3e3d552
Review follow-up. Two findings, both right, and the first is a hole I opened
myself.
`NOPASSWD: iptables *` is a root shell for the web user by another name.
`iptables --modprobe=/path/to/anything` runs that path as root, so a wildcard
grant on iptables escalates rather than restricts. I added that rule while
fixing a permissions gap, which is a worse outcome than the gap. It is gone,
and a test now fails on any trailing-wildcard grant to a tool that can execute
another program -- iptables, nft, tcpdump, find, awk, sed, perl, python, env.
The other finding: checking only the binary made the coverage test far weaker
than it looked. With `sysctl` present anywhere in the allow-list, deleting the
`net.ipv4.ip_forward=0` grant still passed -- and the portal would then be
unable to restore forwarding on teardown. Each required command is now matched
in full, and each is mutation-checked individually, including that exact
single-line case.
Scope pulled in deliberately. The first version of this test tried to assert
that *every* sudo call in the codebase is granted. Run honestly, it showed the
portal also runs iptables, nft, `ip addr`, `ip link` and `cp` with arguments
built at runtime -- an interface name, a port. Those cannot be granted safely
in a sudoers file: the rule needs a trailing wildcard, and that is the
escalation above. Closing that half needs a privileged helper that builds the
rules itself and takes only an interface and a port, granted the way
safe_plugin_rm.sh already is. That is a design decision, not a one-line grant,
so the test now pins the four commands this change actually grants and the
docstring says plainly what it does not cover.
Better a narrow test that is true than a broad one that is not.
(cherry picked from commit 500cfbc9f4)
Installation Scripts
This directory contains scripts for installing and configuring the LEDMatrix system.
Scripts
one-shot-install.sh- Single-command installer; clones the repo, checks prerequisites, then runsfirst_time_install.sh. Invoked viacurl ... | bashfrom the project root README.install_service.sh- Installs the main LED Matrix display service (systemd)install_web_service.sh- Installs the web interface service (systemd)install_wifi_monitor.sh- Installs the WiFi monitor daemon servicesetup_cache.sh- Sets up persistent cache directory with proper permissionsconfigure_web_sudo.sh- Configures passwordless sudo access for web interface actionsconfigure_wifi_permissions.sh- Grants theledmatrixuser the WiFi management permissions needed by the web interface and the WiFi monitor servicemigrate_config.sh- Migrates configuration files to new formats (if needed)debug_install.sh- Diagnostic helper used when an install fails; collects environment info and recent logs
Usage
These scripts are typically called by first_time_install.sh in the
project root (which itself is invoked by one-shot-install.sh), but
can also be run individually if needed.
Note: Most installation scripts require sudo privileges to install systemd services and configure system settings.