fix(edaas): restore passwordless wheel under sudo-rs #102

2026-08-24T11:16:59+01:00

lyrathorpe commented

2026-08-24 11:16:59 +01:00

Problem

feat(security): swap sudo for the memory-safe sudo-rs (#95) broke privilege
escalation on the WSL host. NixOS-WSL ships
security.sudo.wheelNeedsPassword = false -- WSL has no console login, so the
trust boundary is the Windows session and the Linux account password is set by
the installer, not by the user. That default is an option of the
security.sudo module and does not carry across to security.sudo-rs, whose
own wheelNeedsPassword defaults to true.

Comparing the generated sudoers either side of the swap:

before: %wheel ALL=(ALL:ALL) NOPASSWD:SETENV: ALL
after:  %wheel ALL=(ALL:ALL)          SETENV: ALL

Since then sudo prompts for a password nobody knows; the only route to root
was wsl -u root -d NixOS.

Change

hosts/EDaaS/configuration.nix -- set
security.sudo-rs.wheelNeedsPassword = false, matching the NixOS-WSL
default. Scoped to the host, so the other NixOS machines keep the prompt.
docs/shell.md -- the sudo-rs section no longer claims the whole fleet
requires a password; the per-host table records the difference.

Testing

Built and switched on the host via a root shell; sudo -n id returns
uid=0(root) where it previously demanded interactive authentication.
nix fmt clean.

## Problem `feat(security): swap sudo for the memory-safe sudo-rs` (#95) broke privilege escalation on the WSL host. NixOS-WSL ships `security.sudo.wheelNeedsPassword = false` -- WSL has no console login, so the trust boundary is the Windows session and the Linux account password is set by the installer, not by the user. That default is an option of the `security.sudo` module and does not carry across to `security.sudo-rs`, whose own `wheelNeedsPassword` defaults to `true`. Comparing the generated sudoers either side of the swap: before: %wheel ALL=(ALL:ALL) NOPASSWD:SETENV: ALL after: %wheel ALL=(ALL:ALL) SETENV: ALL Since then `sudo` prompts for a password nobody knows; the only route to root was `wsl -u root -d NixOS`. ## Change - `hosts/EDaaS/configuration.nix` -- set `security.sudo-rs.wheelNeedsPassword = false`, matching the NixOS-WSL default. Scoped to the host, so the other NixOS machines keep the prompt. - `docs/shell.md` -- the sudo-rs section no longer claims the whole fleet requires a password; the per-host table records the difference. ## Testing Built and switched on the host via a root shell; `sudo -n id` returns `uid=0(root)` where it previously demanded interactive authentication. `nix fmt` clean.

lyrathorpe added 2 commits 2026-08-24 11:16:59 +01:00

fix(edaas): restore passwordless wheel under sudo-rs 0c151943de

NixOS-WSL sets `security.sudo.wheelNeedsPassword = false`, but that option
belongs to the `security.sudo` module and does not carry over to the sudo-rs
swap in modules/common-nixos.nix, whose equivalent option defaults to true.
Since that swap landed, sudo on this host prompts for the account password --
which WSL set during install and nobody knows -- so escalation only worked
through `wsl -u root`.

Set `security.sudo-rs.wheelNeedsPassword = false` on the host to match the
NixOS-WSL default. Other NixOS hosts are unaffected and keep the prompt.

docs(shell): record the EDaaS passwordless-wheel exception

CI / flake (push) Skipped

CI / flake (pull_request) Successful in 4m10s

Details

4ac9d1108b

The sudo-rs section claimed the whole fleet runs the stock "wheel, with a
password" policy, which is no longer true for the WSL host. Explain why the
NixOS-WSL default does not survive the sudo-rs swap, and mark the difference in
the per-host table.

lyrathorpe merged commit 0022a152e3 into main

2026-08-24 13:29:40 +01:00

lyrathorpe deleted branch fix/edaas-passwordless-sudo-rs

2026-08-24 13:29:44 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lyrathorpe/nixfiles#102