Keep temporary sudo grants bounded through lifecycle failures

bin/omarchy-sudo-passwordless

@@ -4,14 +4,20 @@
 # omarchy:args=[MINUTES]
 # omarchy:requires-sudo=true
 
-source "${BASH_SOURCE[0]%/*}/omarchy-security-functions" || exit 126
+if [[ $- != *p* && ${BASH_SOURCE[0]} == "$0" ]]; then
+  echo "Refusing an unsafe Bash startup for passwordless sudo." >&2
+  exit 126
+fi
+
+security_entrypoint=$(/usr/bin/readlink -e -- "${BASH_SOURCE[0]}") || exit 126
+source "${security_entrypoint%/*}/omarchy-security-functions" || exit 126
 
 if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
   omarchy_security_require_privileged_bash_startup || {
     echo "Refusing an unsafe Bash startup for passwordless sudo." >&2
     exit 126
   }
-  unset BASH_ENV ENV
+  omarchy_security_sanitize_bash_environment "$0" "$@" || exit 126
 fi
 
 set -euo pipefail
@@ -22,7 +28,9 @@ readonly STATE_DIR=/var/lib/omarchy/sudo-passwordless
 readonly RUNTIME_DIR=/run/omarchy/sudo-passwordless
 readonly LOCK_FILE=/run/lock/omarchy-sudo-passwordless.lock
 readonly BOOT_CLEANUP_FILE=/etc/tmpfiles.d/omarchy-nopasswd-sudo.conf
+readonly REMOVAL_BLOCKER=/run/omarchy-sudo-passwordless-package-removing
 readonly INSTALLED_SELF=/usr/bin/omarchy-sudo-passwordless
+readonly STATUS_INACTIVE=3
 
 usage() {
   echo "Usage: omarchy-sudo-passwordless [MINUTES]" >&2
@@ -31,15 +39,15 @@ usage() {
 }
 
 valid_minutes() {
-  [[ $1 =~ ^[0-9]+$ ]] && ((10#$1 >= 1 && 10#$1 <= MAX_MINUTES))
+  [[ $1 =~ ^0*[1-9][0-9]{0,3}$ ]] && ((10#$1 <= MAX_MINUTES))
 }
 
 valid_uid() {
-  [[ $1 =~ ^[0-9]+$ ]] && ((10#$1 >= 1 && 10#$1 <= 4294967294))
+  [[ $1 =~ ^0*[1-9][0-9]{0,9}$ ]] && ((10#$1 <= 4294967294))
 }
 
 valid_account_name() {
-  [[ $1 =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]
+  [[ $1 =~ ^[a-z_][a-z0-9_-]{0,31}\$?$ ]] && (( ${#1} <= 32 ))
 }
 
 resolve_account() {
@@ -191,10 +199,13 @@ remove_known_legacy_rules() {
       # must not survive the next boot. Do not require the account to still
       # exist: a deleted account could otherwise make the rule immortal and a
       # later username reuse could activate it again.
-      /usr/bin/rm -f -- "$file" || failed=1
-      [[ -z $GENERATED_RULE_LEGACY_TIMER ]] ||
-        /usr/bin/systemctl stop "${GENERATED_RULE_LEGACY_TIMER}.timer" \
-          "${GENERATED_RULE_LEGACY_TIMER}.service" >/dev/null 2>&1 || true
+      if /usr/bin/rm -f -- "$file" && [[ ! -e $file && ! -L $file ]]; then
+        [[ -z $GENERATED_RULE_LEGACY_TIMER ]] ||
+          /usr/bin/systemctl stop "${GENERATED_RULE_LEGACY_TIMER}.timer" \
+            "${GENERATED_RULE_LEGACY_TIMER}.service" >/dev/null 2>&1 || true
+      else
+        failed=1
+      fi
     else
       classification=$?
       # An unreadable candidate cannot be proven inert. A symlink, non-file,
@@ -213,6 +224,7 @@ cleanup_uid_locked() {
   # Remove policy first. A failed timer stop can only leave an inert cleanup
   # job behind, never extend passwordless access.
   /usr/bin/rm -f -- "$(rule_file "$uid")" || return 1
+  [[ ! -e $(rule_file "$uid") && ! -L $(rule_file "$uid") ]] || return 1
   /usr/bin/rm -f -- "$(state_file "$uid")" || return 1
   [[ -z $timer ]] || stop_timer "$timer"
 }
@@ -246,6 +258,7 @@ cleanup_all_locked() {
 
 verify_boot_cleanup() {
   local owner mode canonical current active_rules
+  [[ ! -e $REMOVAL_BLOCKER && ! -L $REMOVAL_BLOCKER ]] || return 1
   [[ -f $BOOT_CLEANUP_FILE && ! -L $BOOT_CLEANUP_FILE ]] || return 1
   canonical=$(/usr/bin/realpath -e -- "$BOOT_CLEANUP_FILE") || return 1
   [[ $canonical == "$BOOT_CLEANUP_FILE" ]] || return 1
@@ -288,7 +301,7 @@ start_expiry_timer() {
   # a monotonic OnActiveSec timer pauses while the machine is suspended.
   /usr/bin/systemd-run --quiet --collect --on-calendar="@${expires}" \
     --timer-property=AccuracySec=1s --unit="$timer" \
-    -- "$INSTALLED_SELF" __expire "$uid" || return 1
+    -- "$INSTALLED_SELF" __expire "$uid" "$timer" || return 1
   /usr/bin/systemctl is-active --quiet "${timer}.timer"
 }
 
@@ -306,6 +319,20 @@ publish_rule() {
   /usr/bin/rm -f -- "$tmp"
 }
 
+abort_enable_locked() {
+  local uid=$1 timer=$2 old_timer=$3 pending_state=$4
+  # Publication can install policy and then fail while cleaning its temporary
+  # file. Never disarm either expiry job until policy revocation is confirmed.
+  if cleanup_uid_locked "$uid"; then
+    stop_timer "$timer"
+    [[ -z $old_timer ]] || stop_timer "$old_timer"
+  else
+    echo "Could not revoke passwordless sudo after a failed grant; expiry jobs remain armed. Administrator cleanup is required." >&2
+  fi
+  /usr/bin/rm -f -- "$pending_state" || true
+  return 1
+}
+
 enable_locked() {
   local uid="$1" minutes="$2" old_timer="" timer token expires pending_state now
   resolve_account "$uid" || return 1
@@ -329,34 +356,26 @@ enable_locked() {
   # grant rather than extending it.
   pending_state=$(prepare_state_file "$uid" "$ACCOUNT_NAME" "$expires" "$timer") || return 1
   if ! start_expiry_timer "$uid" "$expires" "$timer"; then
-    /usr/bin/rm -f -- "$pending_state"
-    # Preserve the predecessor fix's fail-closed extension semantics: a caller
-    # must never mistake a failed replacement for a safely extended grant.
-    # The old timer is still armed here, but revoking the old rule as well is
-    # the unambiguous failure state.
-    cleanup_uid_locked "$uid" || true
+    abort_enable_locked "$uid" "$timer" "$old_timer" "$pending_state"
     return 1
   fi
   if ! /usr/bin/mv -fT -- "$pending_state" "$(state_file "$uid")"; then
-    stop_timer "$timer"
-    /usr/bin/rm -f -- "$pending_state"
-    cleanup_uid_locked "$uid" || true
+    abort_enable_locked "$uid" "$timer" "$old_timer" "$pending_state"
     return 1
   fi
-  if ! publish_rule "$uid" "$ACCOUNT_NAME"; then
-    stop_timer "$timer"
-    /usr/bin/rm -f -- "$(state_file "$uid")" "$(rule_file "$uid")"
+  if ! verify_boot_cleanup || ! publish_rule "$uid" "$ACCOUNT_NAME"; then
+    abort_enable_locked "$uid" "$timer" "$old_timer" "$pending_state"
     return 1
   fi
   now=$(current_epoch) || {
-    cleanup_uid_locked "$uid" || true
+    abort_enable_locked "$uid" "$timer" "$old_timer" "$pending_state"
     return 1
   }
-  if ((10#$now >= 10#$expires)) || ! /usr/bin/systemctl is-active --quiet "${timer}.timer"; then
+  if ((10#$now >= 10#$expires)) || ! /usr/bin/systemctl is-active --quiet "${timer}.timer" || ! verify_boot_cleanup; then
     # The timer may have expired or failed between its initial verification and
     # rule publication. Revoke synchronously so a suspended or heavily loaded
     # machine cannot turn a short grant into a reboot-long one.
-    cleanup_uid_locked "$uid" || true
+    abort_enable_locked "$uid" "$timer" "$old_timer" "$pending_state"
     return 1
   fi
   [[ -z $old_timer || $old_timer == "$timer" ]] || stop_timer "$old_timer"
@@ -364,40 +383,68 @@ enable_locked() {
 
 status_locked() {
   local uid="$1" record state_name expires timer now remainder
-  resolve_account "$uid" || return 1
-  [[ -f $(rule_file "$uid") && ! -L $(rule_file "$uid") ]] || return 1
+  resolve_account "$uid" || return 2
+  if [[ ! -e $(rule_file "$uid") && ! -L $(rule_file "$uid") ]]; then
+    return "$STATUS_INACTIVE"
+  fi
   record=$(read_state_record "$uid") || {
-    cleanup_uid_locked "$uid"
-    return 1
+    revoke_inactive_grant "$uid"
+    return $?
   }
   state_name=${record%%$'\t'*}
   remainder=${record#*$'\t'}
   expires=${remainder%%$'\t'*}
   timer=${record##*$'\t'}
   [[ $state_name == "$ACCOUNT_NAME" ]] || {
-    cleanup_uid_locked "$uid"
-    return 1
+    revoke_inactive_grant "$uid"
+    return $?
   }
   now=$(current_epoch) || {
-    cleanup_uid_locked "$uid"
-    return 1
+    revoke_inactive_grant "$uid"
+    return $?
   }
   ((10#$now < 10#$expires)) || {
-    cleanup_uid_locked "$uid"
-    return 1
+    revoke_inactive_grant "$uid"
+    return $?
   }
   /usr/bin/systemctl is-active --quiet "${timer}.timer" || {
-    cleanup_uid_locked "$uid"
-    return 1
+    revoke_inactive_grant "$uid"
+    return $?
   }
 }
 
+revoke_inactive_grant() {
+  if cleanup_uid_locked "$1"; then
+    return "$STATUS_INACTIVE"
+  else
+    echo "Could not revoke invalid or expired passwordless sudo. Administrator cleanup is required." >&2
+    return 2
+  fi
+}
+
+expire_locked() {
+  local uid=$1 timer=${2:-} current_timer status
+  if [[ -n $timer ]]; then
+    current_timer=$(read_state_timer "$uid" 2>/dev/null || true)
+    # A delayed predecessor must not revoke a newer, independently timed grant.
+    [[ -z $current_timer || $current_timer == "$timer" ]] || return 0
+    cleanup_uid_locked "$uid"
+  elif status_locked "$uid"; then
+    # Compatibility with already scheduled UID-only jobs: enforce the current
+    # grant's expiry instead of letting an old timer shorten its replacement.
+    return 0
+  else
+    status=$?
+    (( status == STATUS_INACTIVE ))
+  fi
+}
+
 root_dispatch() {
   local action="$1"
   shift
   case "$action" in
     __status)
-      (($# == 1)) && verify_sudo_caller "$1" || return 1
+      (($# == 1)) && verify_sudo_caller "$1" || return 2
       with_root_lock status_locked "$1"
       ;;
     __enable)
@@ -409,8 +456,9 @@ root_dispatch() {
       with_root_lock cleanup_uid_locked "$1"
       ;;
     __expire)
-      (($# == 1)) && ((EUID == 0)) && valid_uid "$1" || return 1
-      with_root_lock cleanup_uid_locked "$1"
+      (($# == 1 || $# == 2)) && ((EUID == 0)) && valid_uid "$1" || return 1
+      [[ -z ${2:-} ]] || valid_timer_for_uid "$1" "$2" || return 1
+      with_root_lock expire_locked "$@"
       ;;
     __cleanup-all)
       (($# == 0)) && ((EUID == 0)) || return 1
@@ -459,6 +507,11 @@ if /usr/bin/sudo -N -- "$INSTALLED_SELF" __status "$uid"; then
     echo "Passwordless sudo timer updated. It will automatically disable in ${minutes} minutes."
   fi
 else
+  status=$?
+  if (( status != STATUS_INACTIVE )); then
+    echo "Could not safely inspect passwordless sudo; no grant will be enabled. Resolve the reported authorization or cleanup error first." >&2
+    exit 1
+  fi
   echo ""
   echo "⚠️ WARNING: This will allow ANY process running as your user to"
   echo "execute ANY command as root WITHOUT a password for ${minutes} minutes."