Ryan HughesandGitHub
30d03c4d26
Ship the least-privilege rule with asdcontrol so authorization follows the package lifecycle. Install it after older broad rules for safe staggered upgrades.
5 lines
430 B
Plaintext
5 lines
430 B
Plaintext
# Deny arbitrary asdcontrol arguments before allowing only the operations Omarchy uses.
|
|
# Keep this filename late-sorting so it also overrides stale broader grants.
|
|
ALL ALL=(ALL) !/usr/bin/asdcontrol
|
|
%wheel ALL=(root) NOPASSWD: /usr/bin/asdcontrol ^--detect (/dev/(usb/)?hiddev[0-9]+)( /dev/(usb/)?hiddev[0-9]+)*$, /usr/bin/asdcontrol ^/dev/(usb/)?hiddev[0-9]+$, /usr/bin/asdcontrol ^/dev/(usb/)?hiddev[0-9]+ -- [+-]?[0-9]{1,3}%$
|