From eeb3752074edcb110cd3709689e818b57fd2d2fd Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Wed, 13 May 2026 13:43:31 +0100 Subject: feat(privesc): drop classic sudo via AssumeInstalled base-devel hard-depends on the sudo package, so without help, pacman refuses to remove it. The Arch-native fix is pacman.conf's AssumeInstalled directive: tell pacman to pretend a virtual sudo=99.0 is installed and base-devel's dep is satisfied without actually pulling sudo in. - etc/pacman.conf: AssumeInstalled = sudo=99.0 - bootstrap.sh: after 'just init' (which writes the AssumeInstalled line and installs sudo-rs), Rns the leftover sudo package so a fresh install ends up with sudo-rs only. Also reformat bootstrap.sh and the etc deploy script with the project's shfmt style (-i 2 -ci -s). --- bootstrap.sh | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'bootstrap.sh') diff --git a/bootstrap.sh b/bootstrap.sh index ead79e6..17f7af4 100755 --- a/bootstrap.sh +++ b/bootstrap.sh @@ -67,16 +67,21 @@ else fi # 5. run just init — this deploys chezmoi, installs the 'base' meta list -# (which pulls in sudo-rs), deploys /etc/sudoers-rs and /etc/pam.d/sudo, -# creates /usr/local/bin/{sudo,su,visudo,sudoedit} symlinks pointing at +# (which pulls in sudo-rs), deploys /etc/sudoers-rs, /etc/pam.d/sudo, +# and the AssumeInstalled = sudo line in /etc/pacman.conf, creates +# /usr/local/bin/{sudo,su,visudo,sudoedit} symlinks pointing at # sudo-rs, and installs git hooks. -# The classic 'sudo' package installed in step 2 stays alongside -# sudo-rs as a safety net; remove it manually with `sudo pacman -Rns -# sudo` once you've verified `sudo --version` reports sudo-rs. cd "$DOTFILES_DIR" log 'running just init' just init +# 5b. remove the classic sudo package — base-devel's dependency is +# satisfied by the AssumeInstalled = sudo line written above. +if pacman -Qq sudo >/dev/null 2>&1 && pacman -Qq sudo-rs >/dev/null 2>&1; then + log 'removing classic sudo (sudo-rs takes over)' + sudo pacman -Rns --noconfirm sudo || warn 'failed to remove sudo; remove it manually later' +fi + # 6. refresh pacman mirrorlist once via reflector (config deployed by chezmoi) log 'refreshing pacman mirrorlist via reflector' sudo reflector @/etc/xdg/reflector/reflector.conf \ -- cgit v1.3.1