# Grants the rvc-ssh service account passwordless sudo.
#
# rvc-ssh is a VPN/SSH-replacement remote-admin tool: an operator attached
# via `client <device-id>` (interactive shell) or `exec` needs to actually
# provision/administer the device — install packages, manage docker/podman,
# adjust system config — the same as they would over a direct sudo-capable
# SSH session. Since the PTY/exec child process runs as whatever user the
# agent runs as (see rvc-ssh-agent.service's User=), that means this user.
#
# Security model this implies (see DEVLOG.md's self-update design note):
# whoever can reach this device's Attach/update channel on the hub already
# has root, full stop. Local privilege separation is not the gatekeeper —
# hub-side authentication (mTLS client certs) is, and it must actually be
# enforced for this to be safe. Do not add this file to a fleet where the
# hub accepts unauthenticated Attach/Connect.
rvc-ssh ALL=(ALL) NOPASSWD:ALL
