colibri upgrade: privileged restart/install steps need scoped NOPASSWD sudo (or fail-fast hint) #300

New issue

Open

opened 2026-06-29 07:59:07 +02:00 by clawdie · 1 comment

clawdie commented

2026-06-29 07:59:07 +02:00

Owner

Surfaced by the live colibri upgrade test on debby (Linux), confirmed proven end-to-end otherwise.

The privileged steps in cmd_upgrade (crates/colibri-client/src/bin/colibri.rs) shell out to sudo:

sudo systemctl stop|start colibri-daemon (Linux) / sudo service colibri_daemon stop|start (FreeBSD)
sudo cp target/release/{colibri,colibri-daemon} /usr/local/bin/

Without NOPASSWD or an interactive TTY + askpass, sudo prompts for a password and the upgrade hangs (or fails non-interactively). Same boundary on both platforms (systemd vs rc.d).

Options

Scoped sudoers drop-in (recommended) — the clawdie installer writes a sudoers fragment granting NOPASSWD for only the exact daemon-control + install commands (not blanket sudo). Cross-platform: a systemctl variant and a service variant.
Require running colibri upgrade from an interactive TTY (document it).
Friendly detection — before the first sudo step, probe sudo -n true; if it fails and no TTY, abort early with a clear hint ("upgrade needs passwordless sudo for daemon control — see deployment docs") instead of hanging.

Recommend 1 + 3: ship the scoped sudoers via the installer, and have upgrade fail fast with a hint when it is missing. A matching colibri doctor check ("daemon-control sudo available") would catch it before an upgrade is attempted.

Refs the doctor/upgrade work in #295/#296.

Surfaced by the live `colibri upgrade` test on debby (Linux), confirmed proven end-to-end otherwise. The privileged steps in `cmd_upgrade` (`crates/colibri-client/src/bin/colibri.rs`) shell out to sudo: - `sudo systemctl stop|start colibri-daemon` (Linux) / `sudo service colibri_daemon stop|start` (FreeBSD) - `sudo cp target/release/{colibri,colibri-daemon} /usr/local/bin/` Without **NOPASSWD** or an interactive **TTY + askpass**, sudo prompts for a password and the upgrade hangs (or fails non-interactively). Same boundary on both platforms (systemd vs rc.d). ### Options 1. **Scoped sudoers drop-in (recommended)** — the `clawdie` installer writes a sudoers fragment granting NOPASSWD for *only* the exact daemon-control + install commands (not blanket sudo). Cross-platform: a systemctl variant and a service variant. 2. Require running `colibri upgrade` from an interactive TTY (document it). 3. **Friendly detection** — before the first sudo step, probe `sudo -n true`; if it fails and no TTY, abort early with a clear hint ("upgrade needs passwordless sudo for daemon control — see deployment docs") instead of hanging. Recommend **1 + 3**: ship the scoped sudoers via the installer, and have upgrade fail fast with a hint when it is missing. A matching `colibri doctor` check ("daemon-control sudo available") would catch it before an upgrade is attempted. Refs the doctor/upgrade work in #295/#296.