From 7cc98cd318fc3fc0c8d98195f4b006e3adfc5417 Mon Sep 17 00:00:00 2001 From: Gabriel Brown Date: Fri, 30 Oct 2026 13:57:39 -0400 Subject: [PATCH] Make pwswitch off cover sudo -v, so Panama's installer runs without a password --- user/bin/pwswitch | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/user/bin/pwswitch b/user/bin/pwswitch index 3d7c360..27f99e8 100755 --- a/user/bin/pwswitch +++ b/user/bin/pwswitch @@ -13,7 +13,10 @@ case "${1:-}" in off) tmp="$(mktemp)" trap 'rm -f "$tmp"' EXIT - echo "${user} ALL=(ALL) NOPASSWD: ALL" >"$tmp" + # verifypw=any lets `sudo -v` pass on NOPASSWD alone. Without it, the + # wheel group's password rule still makes -v (and Panama's installer, + # which starts with it) ask for a password. + printf '%s\n' "Defaults:${user} verifypw=any" "${user} ALL=(ALL) NOPASSWD: ALL" >"$tmp" # Validate before installing so a bad file can never lock sudo. sudo visudo -cqf "$tmp" sudo install -m 0440 -o root -g root "$tmp" "$dropin"