OverviewFilesCommitsIssuesDocsReleasesPeers

7rnx-proxy commits / 6d92e0e

1.3.1 — validate sudoers BEFORE installing it
Step 1 wrote /etc/sudoers.d/7rnx-proxy with `sudo tee` and only ran `visudo -c` afterwards, so a malformed write was already live by the time it was detected. The heredoc itself is correct, but the pattern gives no protection when the block is pasted into a terminal rather than executed as a script — and that is what happened: the live file on 7rnx.net contains a stray `EOF` and `sudo chmod 0440 ...` as CONTENT, from a paste where the heredoc delimiter never closed. Every sudo call on that box has printed a syntax error since. Now stages to mktemp, runs `visudo -c` on the staged copy, and aborts with the live file untouched if it does not parse. Install uses install(1) so owner and mode are set atomically — sudo ignores a sudoers.d file that is group- or world-writable, so there must be no window at the wrong mode. Verified: the staged content parses OK, and the same content with the two junk lines appended reproduces the exact error seen in production. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
6d92e0e72864319a2c73c4b083c1a0fe0e3616e9
by plankatron <fleeky@gmail.com> · 2026-08-11T16:54:30.000Z

Changed files (2) +20 -3

package.json +1 -1
……@@ -1,6 +1,6 @@
11{
22 "name": "7rnx-proxy",
3 "version": "1.3.0",
3 "version": "1.3.1",
44 "description": "Reverse proxy management CLI for 7rnx.net Apache2 server",
55 "type": "module",
66 "bin": {
setup-7rnx-server.sh +19 -2
……@@ -9,7 +9,14 @@ PROXY_CONF="/etc/apache2/7rnx-proxy.conf"
99
1010echo "=== Step 1: Sudoers rules ==="
1111
12sudo tee /etc/sudoers.d/7rnx-proxy > /dev/null << 'EOF'
12# Stage to a temp file, VALIDATE, then install. Never write /etc/sudoers.d
13# directly: this block used to `tee` straight to the live path and only run
14# `visudo -c` afterwards, so a malformed write was already installed by the time
15# it was caught. That is exactly how the live file ended up containing a stray
16# `EOF` + `sudo chmod ...` (a paste where the heredoc delimiter never closed),
17# emitting a syntax error on every sudo call for weeks. Validate first.
18SUDOERS_TMP="$(mktemp)"
19cat > "$SUDOERS_TMP" << 'EOF'
1320# Allow fleeky to deploy proxy config and reload Apache (no password)
1421fleeky ALL=(root) NOPASSWD: /bin/cp /tmp/7rnx-proxy.conf /etc/apache2/7rnx-proxy.conf
1522# Host-routed vhosts (vhost mode) — a top-level sites-enabled file (VirtualHost blocks).
……@@ -18,7 +25,17 @@ fleeky ALL=(root) NOPASSWD: /usr/sbin/apachectl configtest
1825fleeky ALL=(root) NOPASSWD: /bin/systemctl reload apache2
1926EOF
2027
21sudo chmod 0440 /etc/sudoers.d/7rnx-proxy
28if ! sudo visudo -c -f "$SUDOERS_TMP"; then
29 rm -f "$SUDOERS_TMP"
30 echo "Sudoers: STAGED FILE IS INVALID — refusing to install. Live file untouched." >&2
31 exit 1
32fi
33
34# install(1) is atomic and sets owner/mode in one step, so there is no window
35# where the file exists with the wrong permissions (sudo ignores a sudoers.d
36# file that is group/world writable).
37sudo install -m 0440 -o root -g root "$SUDOERS_TMP" /etc/sudoers.d/7rnx-proxy
38rm -f "$SUDOERS_TMP"
2239sudo visudo -c -f /etc/sudoers.d/7rnx-proxy
2340echo "Sudoers: OK"
2441