lockdown

Documentation

Index

• func DisableSudoLockdown(cfg *SudoLockdownConfig, logger *slog.Logger) error
• func EnableSudoLockdown(cfg *SudoLockdownConfig, logger *slog.Logger) error
• type SudoLockdownConfig

Functions

func DisableSudoLockdown

func DisableSudoLockdown(cfg *SudoLockdownConfig, logger *slog.Logger) error

DisableSudoLockdown removes the sudoers lockdown configuration, restores disabled sudoers.d files, and re-adds the user to removed groups.

func EnableSudoLockdown

func EnableSudoLockdown(cfg *SudoLockdownConfig, logger *slog.Logger) error

EnableSudoLockdown configures sudoers to restrict what commands can be run with sudo, removes the target user from sudo-granting and docker groups, and disables competing sudoers.d files.

Types

type SudoLockdownConfig

type SudoLockdownConfig struct {
	// AllowCommands is a list of command paths to whitelist via NOPASSWD
	AllowCommands []string
	// Username is the user to configure sudoers for (auto-detected if empty)
	Username string
}

SudoLockdownConfig configures the sudo lockdown behavior