Skip to content

nopass v5.0

Choose a tag to compare

View all tags
@FreddeITsupport98 FreddeITsupport98 released this 12 Jan 15:37
· 16 commits to main since this release
v5
ca846eb

Password-less Release Notes

Date: 2026-01-12

Overview

This release focuses on experimental desktop integration features and much stronger safety warnings around dangerous modes. It is still intended only for single-user, non-critical machines where you fully accept the risks.

New: Root Desktop Unlock (Experimental)

--root-unlock

Status: Experimental, KDE/Plasma + PipeWire focused, NOT recommended for normal use.

This standalone mode tweaks only the root account and then exits without touching normal passwordless sudo / polkit for your regular user. It is meant for cases where you insist on running an entire KDE session as root and still want working audio.

What it does in this mode:

  • Ensures the root account is a member of several desktop / device groups (e.g. audio, video, input, render, tty, etc.) so a root GUI session can see ALSA/PipeWire devices.
  • Updates /etc/pulse/client.conf so that both of the following are enforced:
    • autospawn = yes
    • allow-autospawn-for-root = yes
  • Optionally un-mutes ALSA Master/PCM mixer controls using amixer and then persists the mixer state with alsactl store.
  • Bridges root audio to the normal user’s PipeWire/PulseAudio server by exporting:
    • PULSE_SERVER=unix:/run/user/<UID>/pulse/native
    • XDG_RUNTIME_DIR=/run/user/0
    • DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/0/bus
      into the following files if present (or created):
    • /root/.bashrc
    • /root/.profile
    • /root/.zshrc
  • Detects if the root account appears locked in /etc/shadow (password field begins with ! or *) and, only after explicit confirmation, attempts to unlock it via:
    • sudo passwd -u root

A small state file is written at:

  • /etc/passwordless-fb-root-unlock.state

for use by the restore command.

Important:

  • This has been designed and tested primarily on KDE Plasma + PipeWire.
  • GNOME, XFCE, Hyprland, and other environments are not tested and may behave differently or break.
  • Using --root-unlock implies you are comfortable running a full root GUI session and accept all associated security risks.

--root-unlock-restore

Companion command to undo as much of the above as possible. It uses the state file and timestamped backups created by --root-unlock.

What it attempts to restore:

  • /etc/pulse/client.conf from the latest .bak.<timestamp> backup.
  • /root/.config/pulse, /root/.config/pipewire, and /root/.local/state/wireplumber from the latest *.bak.<timestamp> directories.
  • The previous linger state for root (enabled/disabled) and the prior pulseaudio.service enable/active state.
  • Removal of the injected environment exports (and their comments) from:
    • /root/.bashrc
    • /root/.profile
    • /root/.zshrc
  • Removal of any groups that --root-unlock recorded as newly added for root.

This is a best-effort undo, not a hard guarantee. If the state file or backups are missing or corrupted, some changes may not be fully reverted.

New: Root Account Lock Detection and Optional Unlock

In --root-unlock mode the script now:

  • Reads root’s password field from /etc/shadow.
  • Treats a leading ! or * as a locked account.
  • If locked, prints clear warnings and prompts you whether to unlock.
  • Only runs sudo passwd -u root when you explicitly confirm (or when --yes is set).
  • Does nothing in --dry-run beyond logging what it would attempt.

This is intended to make it easier to log into a root GUI session when the distribution ships with a locked root account, while still requiring an explicit, informed decision.

Hardened: --full-file-permissions (EXPERIMENTAL, NOT READY FOR USE)

The --full-file-permissions mode is now clearly marked as experimental and not ready for normal use.

Behavior:

  • Skips the normal passwordless sudo / polkit / group / PAM configuration and runs only a recursive ACL grant equivalent to:

    setfacl -R -m u:<TARGET_USER>:rwx /

  • Uses find + setfacl with exclusions for pseudo-filesystems and some network/service directories to reduce the chance of catastrophic breakage.

  • Shows detailed progress via pv, and a small sample of setfacl error messages at the end.

Additional warnings added in this release:

  • Every time --full-file-permissions is used, the script prints multiple high-visibility warnings:

    • It is an experimental feature, work in progress.
    • It will attempt to grant rwx ACLs on most of /.
    • It is very likely to permanently break your system (networking, display, services, etc.).
    • It should only be used on throwaway test installs with offline backups, and by users who intentionally want to stress or break the system.

  • The README now explicitly states that this mode is for experimentation only and that you should expect to need a full reinstall or offline repair after serious use.

Other Improvements

  • Stronger, clearer runtime warnings for:
    • --root-unlock
    • --root-unlock-restore
    • --full-file-permissions
  • Extended environment bridging for root shells across:
    • /root/.bashrc
    • /root/.profile
    • /root/.zshrc (if present)
  • More robust state-file writing for --root-unlock so that multi-line systemctl diagnostics cannot corrupt the state file.

Known Limitations

  • --root-unlock is only tested on openSUSE Tumbleweed + KDE Plasma + PipeWire in a single-user configuration.
  • GNOME, XFCE, Hyprland, and other desktops are not tested. Audio, login flows, or session services may break.
  • --full-file-permissions remains an experimental feature: treat it as a destructive testing tool, not a supported configuration step.

Final Notes

This project remains targeted at advanced users who are comfortable reading shell scripts, understand Linux permissions and ACLs, and are willing to accept the risk of data loss and system breakage.

If you are unsure whether you should use any of these new options, you probably should not use them yet.

Assets 3
Loading