nopass v2.0

# v2.0 – Stronger Warnings, Group Changes, and Docs Update

## ⚠️ Critical Security & Warranty Warning

This script is a **dangerous** convenience tool. It is intended only for advanced users who fully understand the risks.

- It can give the target user **root-equivalent power with no password**.
- It may add the user to highly privileged groups such as `root`, `disk`, `shadow`, and `kmem`.
- With these privileges, the user (or any process running as that user) can:
  - Run **any command as root** via `sudo` without a password.
  - Bypass many desktop/admin prompts via **polkit auto-approval**.
  - Access **raw disks**, kernel interfaces, and **sensitive files** (including password hashes) even *without* `sudo`.

**If this account is ever compromised, you should assume full system compromise.**

This project and release are provided **“AS IS”**, **without any warranty** of any kind.  
I am the original author of the script** and make **no guarantees** about:

- Security
- Correctness
- Fitness for any particular purpose
- Suitability for your environment

By downloading, installing, or running this script, **you accept all risk**, including but not limited to:

- Data loss or corruption  
- Security breaches and privilege escalation  
- Service outages or downtime  
- Violations of policies, contracts, or laws in your environment  

If you do **not** fully understand or accept these risks, **do not install or run this script**.

---

## What’s New in This Release

### 1. Group Membership Changes

The script now, when configuring a user (not in `--restore` or `--verify-only` modes), attempts to ensure the target user is a member of several privileged groups:

- `root`
- `disk`
- `shadow`
- `kmem`

This is done via `usermod -aG <group> <user>` and is **idempotent** (it will not re-add if already present).

**Implications:**

- `disk`: potential access to raw block devices → can read/write disks directly.
- `shadow`: potential access to `/etc/shadow` → password hashes, credential material.
- `kmem` (where present): potential access to low-level kernel memory interfaces.

These additions **further increase** the power and risk of the target account.  
Use **only** on machines where this is acceptable and understood.

## v2.0 – Optional AppArmor/SELinux Relaxation

- Added a new **optional** flag `--relax-mac`:
  - Best-effort stops the **AppArmor** service at runtime (if present).
  - Best-effort sets **SELinux** to **permissive** at runtime (if present).
  - Always logs what it’s doing and still prompts for confirmation unless `--yes` is used.
- By default, **nothing changes** for AppArmor/SELinux; you must explicitly pass `--relax-mac`.
- This does not change UIDs, groups, or sudoers, but it **removes important security enforcement layers** 
- and makes any existing privileges more powerful. Use only if you fully understand and accept the risk.

## v2.0 – Optional AppArmor/SELinux Relaxation + MAC Status in Verify

- Added a new **optional** flag `--relax-mac`:
  - Best-effort stops the **AppArmor** service at runtime (if present).
  - Best-effort sets **SELinux** to **permissive** at runtime (if present).
  - Always logs what it’s doing and still prompts for confirmation unless `--yes` is used.
- `--verify` mode now also prints a **MAC status summary** (AppArmor present/active, SELinux mode).  
  No MAC changes are ever made in verify-only mode; it’s informational only.
- As before, this does not change UIDs, groups, or sudoers, but **relaxing MAC reduces system security** and makes any existing privileges more powerful. Use only if you fully understand and accept the risk.

### 2. Expanded README Security Section

`readme.md` has been updated with:

- Explicit **security warnings** and a **legal/warranty disclaimer**.
- Clear statements that:
  - The script can fully subvert normal protections like `sudo` prompts.
  - The user must assume full compromise if the target account is abused.
- Practical guidance on safer usage:
  - Restricting this to **single-user, non-critical systems**.
  - Being careful with **SSH/remote access**.
  - Using **strong login passwords** and, where possible, full disk encryption.
  - Avoiding execution of random/untrusted code under this powerful account.
  - Keeping backups of `/etc/sudoers`, `/etc/sudoers.d`, and polkit rules.

### 3. Documentation Clarifications

- Clarified what the script actually does with:
  - `/etc/sudoers.d/<user>-passwordless`
  - `/etc/sudoers`
  - `/etc/polkit-1/rules.d/00-allow-<user>-everything.rules`
- Emphasized that the script is **idempotent** and uses `visudo` checks and backups (when `--force` is used).

---

## Installation Warning

Before installing or running this version:

1. **Review the code** yourself.  
   Do not run any script you have not personally inspected and understood.

2. **Read the README security section carefully.**  
   If anything there is unclear, **stop** and do not use the script.

3. **Back up your configuration:**

   - `/etc/sudoers`
   - `/etc/sudoers.d/`
   - `/etc/polkit-1/rules.d/`

4. **Test in a disposable environment first** (VM, test machine).  
   Verify behavior and recovery before applying to anything you care about.

---

## How to Install (If You Accept the Risks)

```bash
git clone https://github.com/<your-username>/Password-less.git
cd Password-less
chmod +x setup-passwordless-fb.sh

Then run, for example (for the current user):

./setup-passwordless-fb.sh --yes --force

Or sudo-only, no polkit:

./setup-passwordless-fb.sh --sudo-only --yes --force

Again: If you are not 100% sure what this does, do not install or run it.

If you tell me your intended version number and repo URL, I can customize the header and commands exactly for your release.