iclaoudezinandClaude Sonnet 5.5
6f9e800779
- Profiler: when not root, render server.conf to the staging dir and let the root helper validate (directive allowlist) and install it; control the openvpn service through the helper (doas, fixed commands). - Add ovpmon-helper and doas rules under DOCS/General/privilege-separation. - Document the design, rollout, results and limitations. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
8 lines
542 B
Plaintext
8 lines
542 B
Plaintext
# /etc/doas.d/ovpmon.conf (root:root 640)
|
|
# The unprivileged ovpmon service user may run exactly these helper commands as root.
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args install-config
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service start
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service stop
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service restart
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service status
|