Skip to content

nopass v4.0

Choose a tag to compare

View all tags
@FreddeITsupport98 FreddeITsupport98 released this 10 Jan 20:26
· 28 commits to main since this release
v4
dcfb8ce

Password-less – Release (2026-01-10)

This release captures all recent work on setup-passwordless-fb.sh, focusing on:

  • safer, more transparent handling of the extremely dangerous --full-file-permissions mode
  • better progress and error visibility during ACL application
  • a periodic systemd service/timer for re-applying full ACLs
  • GUI/desktop integration and safer behavior on modern distros
  1. CLI and Options

New/updated flags:

  • --full-file-permissions

    • Nuclear option that runs a recursive ACL grant equivalent to:
      • setfacl -R -m u:<TARGET_USER>:rwx /
    • Now wrapped with:
      • multiple warnings and explicit confirmation prompts
      • pv-based progress display with total item count and items/sec
      • a concise post-run summary including elapsed time and approximate throughput
      • compact sampling of ACL errors instead of a wall of stderr

  • --install-full-file-permissions-service

    • Installs a systemd service + timer (passwordless-fb-fullacl.service / passwordless-fb-fullacl.timer) that periodically re-applies --full-file-permissions.
    • When invoked by itself, the script enters an installer-only mode:
      • asks for confirmation
      • writes or reuses /etc/passwordless-fb-fullacl.conf
      • generates service + timer units
      • runs systemctl daemon-reload and systemctl enable --now passwordless-fb-fullacl.timer
      • exits without touching sudoers, polkit, groups, or anything else

  • --uninstall-full-file-permissions-service

    • Uninstalls the periodic ACL service and timer.
    • When invoked by itself, runs in an uninstaller-only mode:
      • asks for confirmation
      • disables and stops the timer if present
      • removes the .service, .timer, and /etc/passwordless-fb-fullacl.conf
      • runs systemctl daemon-reload
      • exits without modifying sudoers, polkit, or other configuration

Other options and behavior (passwordless sudo, polkit integration, --relax-mac, --all-groups, --delete-passwd-on-polkit-fail, --restore, --verify-only) remain as described in the README, but have been re-documented more thoroughly.

  1. Full-file-permissions ACL Engine Improvements

The --full-file-permissions logic has been heavily refined:

  • Dependency handling

    • When --full-file-permissions or the full-ACL systemd service is requested and pv is missing, the script now treats pv as a dependency and installs it via the detected package manager (e.g. zypper, dnf, apt, etc.), unless --no-install is supplied.

  • Progress bar and throughput

    • Before running setfacl, the script counts how many filesystem entries will be processed:
      • prints [info] Found N items. Starting ACL application with progress bar...
    • Uses pv -l to show a live progress bar with:
      • current / total items
      • percentage
      • approximate items/sec
      • ETA
    • Measures elapsed time and prints a human-readable summary, e.g.:
      • [info] Successfully applied ACLs to approximately 234882 items in 42s (~5592 items/sec).

  • Error capture and sampling

    • setfacl stderr is piped through a small filter and also tee’d to a temporary log.
    • Rather than dumping every error line, the script now:
      • extracts unique messages
      • prints up to 5 as [acl-error] ... so the user can see the types of failures (e.g. read‑only filesystems, unsupported ACLs, missing paths), without being overwhelmed.
    • This maintains visibility into problems while avoiding an unreadable wall of output.

  • Non-fatal behavior

    • Even when some paths fail (common on /proc, /sys, read‑only mounts, etc.), the script:
      • records that ACL application had errors
      • surfaces a clear warning and the sample of error lines
      • continues with the rest of the script instead of bailing out mid-run
  1. Desktop Notifications and UX

For --full-file-permissions runs (both interactive and via the systemd service), the script now provides optional desktop notifications when notify-send and a graphical session are available:

  • Start notification

    • e.g. "Applying recursive ACLs on / for . This may take a while and can affect many files."

  • Finish notification

    • On success: "ACL application on / for is complete. Full-file-permissions are now in effect."
    • On error: "ACL application on / for finished with some errors. Check terminal output if you care about 100% coverage."

The script makes a best-effort attempt to target the user’s D-Bus session bus when running as root (e.g. under systemd). If there is no GUI or notify-send is missing, notifications are quietly skipped.

  1. Systemd Service + Timer (passwordless-fb-fullacl)

A new systemd-based mechanism allows re-applying full ACLs on a schedule.

  • Configuration file: /etc/passwordless-fb-fullacl.conf

    • ACL_TARGET_USER:
      • user that should receive full-file-permissions ACLs
      • defaults to the invoking user at install time if not explicitly set
    • ACL_EXTRA_ARGS:
      • extra arguments passed to setup-passwordless-fb.sh when run from the service
      • defaults to --sudo-only --no-install --yes
    • ACL_ONCALENDAR:
      • systemd OnCalendar= expression controlling the schedule
      • defaults to daily, but can be set to hourly, Mon..Fri 02:00, etc.

  • Service unit: passwordless-fb-fullacl.service

    • One-shot unit that runs the script approximately as:
      • ExecStart=/usr/bin/env bash /path/to/setup-passwordless-fb.sh --user <resolved-target> --full-file-permissions ${ACL_EXTRA_ARGS}
    • The <resolved-target> username is baked into the unit at install time to avoid set -u issues with unset environment variables.

  • Timer unit: passwordless-fb-fullacl.timer

    • Triggers the service according to ACL_ONCALENDAR.
    • Enabled/started by the installer mode when --install-full-file-permissions-service is used on its own.

  • Exclusive install/uninstall paths

    • --install-full-file-permissions-service alone:
      • confirmation -> write/reuse env file -> write units -> daemon-reload -> enable/now -> exit.
    • --uninstall-full-file-permissions-service alone:
      • confirmation -> disable/stop timer -> remove units + env -> daemon-reload -> exit.
  1. KDE and PAM Integration

  • KDE kdesu integration

    • On KDE/Plasma systems with kwriteconfig5, the script sets kdesu to use sudo instead of su:
      • kwriteconfig5 --file kdesurc --group super-user-command --key super-user-command sudo
    • This makes graphical "Run as root" dialogs follow the same passwordless sudo configuration as the terminal.

  • PAM su for wheel users

    • If a PAM su/su-l service exists (or a vendor file is present that can be copied into /etc/pam.d), the script:
      • ensures a pam_wheel.so line exists with trust and group=wheel
      • makes su passwordless for users in the wheel group
      • does so in an idempotent, cross‑distro‑friendly way, with backups when overwriting
  1. Safety, Idempotency, and Uninstall Notes

  • Safety checks

    • Refuses to target root as the passwordless user.
    • Always uses visudo to validate sudoers fragments and the final /etc/sudoers.
    • Backs up key files (sudoers, polkit rules, PAM configs) with timestamped .bak.* suffixes when --force is used.

  • Idempotency

    • Re-running the script:
      • does not re-add duplicate sudoers or PAM lines
      • skips rewriting sudoers/polkit configs when they already match the desired content
      • recognizes its own comments/markers and avoids stacking changes.

  • Undo/rollback

    • Normal sudo/polkit/PAM changes can be reverted using:
      • removal of sudoers drop-ins
      • visudo edits and the .bak.* backups
      • removal of polkit .rules files
    • --full-file-permissions ACLs remain inherently hard to fully undo; in many cases, a reinstall is the only truly clean revert.
  1. Documentation

README.md has been fully updated to match this release. It now includes:

  • Detailed descriptions of all options, including --full-file-permissions, the systemd service installer/uninstaller, and the polkit/MAC-related flags.
  • A long, explicit warning section explaining why --full-file-permissions is effectively a filesystem-wide superuser grant and why it is so difficult to revert.
  • Examples for:
    • basic passwordless sudo setup
    • sudo + polkit configuration
    • dry-run preview mode
    • installing/uninstalling the full-ACL systemd service
  • Notes on desktop integration (KDE kdesu, PAM su for wheel) and the new pv/notification-based UX for full-ACL runs.
  1. Final Notes

This release continues to assume the same philosophy as before:

  • This script is for single-user, non-critical systems where convenience is prioritized over strict isolation.
  • --full-file-permissions and its systemd service remain extremely dangerous and should only be used by people who fully understand the consequences and are willing to rebuild their system if needed.

If in doubt, stick to --sudo-only and avoid --full-file-permissions entirely.

Assets 3
Loading