39 lines
1.4 KiB
Fish
39 lines
1.4 KiB
Fish
# Copyright (C) 2026 Rootiest
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
# CATEGORY
|
|
# 07-system-and-monitoring
|
|
#
|
|
# SYNOPSIS
|
|
# sudo-toggle
|
|
#
|
|
# DESCRIPTION
|
|
# Toggles the sudo NOPASSWD rule on and off via
|
|
# /etc/sudoers.d/nofail-toggle. Useful for automated tasks that would
|
|
# otherwise require a password entry. Clears the sudo credential cache
|
|
# when re-enabling, so the lockdown takes effect immediately.
|
|
#
|
|
# EXIT STATUS
|
|
# 0 Rule toggled
|
|
#
|
|
# EXAMPLE
|
|
# sudo-toggle
|
|
function sudo-toggle --description 'Toggle sudo password requirement on/off'
|
|
__fish_help_header (status current-function) $argv; and return 0
|
|
|
|
# Check the file size using sudo stat to see if our bypass rule is active
|
|
set -l file_size (sudo stat -c %s /etc/sudoers.d/nofail-toggle 2>/dev/null)
|
|
|
|
if test -n "$file_size"; and test "$file_size" -gt 0
|
|
# 1. Toggle is currently OFF (Bypass is active). We want to turn security back ON.
|
|
# We use 'sudo -k' to clear the execution cache so it locks down instantly.
|
|
sudo -k truncate -s 0 /etc/sudoers.d/nofail-toggle
|
|
echo "🔒 Sudo security: ENABLED (FIDO Key required)"
|
|
else
|
|
# 2. Toggle is currently ON (Security active). We want to BYPASS it.
|
|
# We write a high-priority user-specific NOPASSWD rule.
|
|
echo "$USER ALL=(ALL:ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/nofail-toggle >/dev/null
|
|
echo "🔓 Sudo security: DISABLED (Bypass active)"
|
|
end
|
|
end
|