nopass v2.1

v2.1 – Experimental --full-file-permissions option

This release introduces an extremely dangerous, opt‑in capability to grant a single user full read/write/execute ACLs across the entire filesystem, alongside existing passwordless sudo/polkit configuration.

New

• --full-file-permissions flag
  • When enabled, the script will (after extra confirmation) run:

    sudo setfacl -R -m u:<TARGET_USER>:rwx /
    
    

give me realise note

Here’s a concise release note you can use, e.g. for vX.Y.Z:

---

Password-less setup-passwordless-fb.sh – Release Notes

New features

• --all-groups flag (extremely dangerous)

  • New opt-in flag --all-groups that:
    • Enumerates every group on the system via getent group.
    • Adds the target user to all groups they are not already a member of.
  • This nearly eliminates all group-based security boundaries between the user and:
    • System services and daemons.
    • Device nodes (disks, video, audio, input, etc.).
    • Logs, sockets, and various service data.
  • Fully documented in the README and clearly marked as extremely dangerous.

• Expanded curated privileged group set

  • In normal mode (without --all-groups), the script now ensures the target user is in a broader set of powerful groups, if they exist:
    • root, disk, wheel, systemd-journal, network, video, audio, input, render, kvm, tty, tape, shadow, kmem, adm.
  • The script checks each group with getent group and only attempts to add the user if the group is present on the system.
  • Re-running the script after installing additional packages/groups will add the user to any newly-present groups from this list.

Documentation and warning updates

• Mandatory reading disclaimer

  • Added a strong statement that users must read the entire README, including all warnings and option descriptions, before running the script.
  • Explicitly states that running the script without understanding it makes any damage or compromise entirely the user’s responsibility.

• High-risk behavior section

  • New “High‑risk behaviors and options (read this first)” section near the top of the README that:
    • Lists all powerful groups the script can add the user to.
    • Explains that the script only adds the user to groups that actually exist, but will include new ones if they appear later and the script is re-run.
    • Summarizes dangerous options:
      • --relax-mac (weakens AppArmor/SELinux).
      • --full-file-permissions (recursive ACL u:<TARGET_USER>:rwx /).
      • --all-groups (member of every group).

• --all-groups option docs

  • Detailed description of --all-groups in the Options section:
    • Clarifies that it uses getent group.
    • Emphasizes that it effectively turns the user into a “member of everything” and that reinstalling the system may be the only safe rollback if something breaks.

Internal / safety checks

• Group existence checks

  • For the curated list of privileged groups, the script now uses getent group to verify that a group exists before calling usermod -aG.
  • Avoids errors on distributions where some of these groups are not defined.

• Syntax validation

  • Script validated with bash -n after changes to ensure there are no syntax errors.