From 3d263bdbb48e7616a12af26ef094e5a416f9a735 Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Wed, 13 May 2026 13:43:31 +0100
Subject: feat(privesc): migrate from opendoas to sudo-rs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

doas's one-shot password and absent 'sudo -v' kept wasting hour-long
paru AUR builds. sudo-rs is a memory-safe Rust rewrite (ISRG/Ferrous
Systems), drop-in CLI compatible, and the same one Ubuntu 25.10 ships
as default. We follow the Arch wiki 'Using sudo-rs without the sudo
package' recipe verbatim — no custom shims.

- meta/base.txt: -doas-sudo-shim +sudo-rs
- etc/sudoers-rs (mode 0440): wiki minimal config + NOPASSWD reboot/poweroff
- etc/pam.d/sudo: 4-line copy of upstream sudo's PAM file
- run_onchange_after_deploy-etc.sh.tmpl: use real sudo, deploy sudoers-rs
  at 0440, create /etc/pam.d/sudo-i and /usr/local/bin/{sudo,sudoedit,
  su,visudo} → sudo-rs symlinks idempotently
- delete etc/doas.conf, dot_local/bin/{doasedit,sudo}
- zshrc: drop sudo=doas/sudoedit=doasedit aliases; rewrite ss/gimme/
  pacdiff/ssys to call sudo
- justfile: s/doas/sudo/g (status/diff/restore helpers)
- nvim: rename :DoasWrite → :SudoWrite (uses sudo -S)
- sway config: reboot/poweroff buttons call sudo
- bootstrap.sh: update step-5 comment
- README/KEYBINDS/copilot-instructions: flip the privesc convention

No Defaults overrides: sudo's defaults (passwd_tries=3,
timestamp_timeout=5) already fix the doas pain, and paru SudoLoop
(kept) refreshes the 5-min window via real sudo -v.
---
 meta/base.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'meta')

diff --git a/meta/base.txt b/meta/base.txt
index 1c6a81b..9c56e52 100644
--- a/meta/base.txt
+++ b/meta/base.txt
@@ -8,7 +8,6 @@ choose
 cpupower
 curlie
 dashbinsh
-doas-sudo-shim
 dog
 duf
 fastfetch
@@ -49,6 +48,7 @@ rsync
 sbctl
 sd
 smartmontools
+sudo-rs
 systemd-resolvconf
 tldr
 tlp
-- 
cgit v1.3.1