35 lines
1.1 KiB
Bash
Executable File
35 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Toggle passwordless sudo for the current user.
|
|
# pwswitch on -> sudo asks for a password again (default behavior)
|
|
# pwswitch off -> sudo runs without a password
|
|
# Works by adding/removing a drop-in file in /etc/sudoers.d.
|
|
set -euo pipefail
|
|
|
|
user="${SUDO_USER:-$USER}"
|
|
# "zz-" prefix so it sorts last and overrides earlier rules.
|
|
dropin="/etc/sudoers.d/zz-passwordswitch-${user}"
|
|
|
|
case "${1:-}" in
|
|
off)
|
|
tmp="$(mktemp)"
|
|
trap 'rm -f "$tmp"' EXIT
|
|
# verifypw=any lets `sudo -v` pass on NOPASSWD alone. Without it, the
|
|
# wheel group's password rule still makes -v (and Panama's installer,
|
|
# which starts with it) ask for a password.
|
|
printf '%s\n' "Defaults:${user} verifypw=any" "${user} ALL=(ALL) NOPASSWD: ALL" >"$tmp"
|
|
# Validate before installing so a bad file can never lock sudo.
|
|
sudo visudo -cqf "$tmp"
|
|
sudo install -m 0440 -o root -g root "$tmp" "$dropin"
|
|
echo "Passwordless sudo ENABLED for ${user}. Run '$(basename "$0") on' when done."
|
|
;;
|
|
on)
|
|
sudo rm -f "$dropin"
|
|
sudo -k
|
|
echo "Password required for sudo again."
|
|
;;
|
|
*)
|
|
echo "Usage: $(basename "$0") on|off" >&2
|
|
exit 1
|
|
;;
|
|
esac
|