Password-less – Release Notes

Unversioned changes (latest)

Improved PAM su integration for passwordless su via the wheel group:
- Locates su/su-l PAM configs in /etc/pam.d or vendor files in /usr/lib/pam.d and creates local overrides when needed.
- If a pam_wheel.so line already exists, only adds the trust option (without duplicating the line).
- If no pam_wheel.so line exists, injects a single
  auth sufficient pam_wheel.so use_uid trust group=wheel
  line either immediately after the pam_rootok.so auth line (preferred) or near the top of the file as a fallback.
- Changes are idempotent: re-running the script does not keep adding extra pam_wheel.so lines or trust flags.
Tightened polkit detection for newer versions (e.g. polkit-1 124+):
- Uses pkaction --version to detect newer polkit.
- Scans common rules directories for existing JS .rules files containing polkit.addRule; if none are found, treats JS rules as "maybe unsupported".
Added optional --delete-passwd-on-polkit-fail flag:
- When JS rules look unsupported, and this flag is set, the script can offer to delete the local Unix password for the target user via sudo passwd -d <TARGET_USER> (with confirmation and full support for --dry-run).
Verified the script passes a basic syntax check (bash -n).

Added a section “Why passwordless sudo / su and what this script is for” explaining the intended use case (single-user personal/lab machines, convenience over isolation, reproducible config).
Expanded the feature and options sections to document:
- PAM su passwordless behavior for wheel members and its idempotent, cross-distro design.
- The --delete-passwd-on-polkit-fail flag and how it interacts with polkit detection.
- The tightened polkit JS detection heuristics (version check + scan for existing JS rules).

These notes describe the current state after the latest edits to the script and README.