Remove the residual root escalation left after the sudoers narrowing (TASK-445) - #471

Merged

KrasimirKralev merged 18 commits into

betafrom

fix/hermes-sudoers-445-r2

Aug 27, 2026

Commits on Aug 24, 2026

Add a fail-closed sudoers coverage check and prune 10 dead grants (TASK-445)
KrasimirKralev
committed
c0832b4
Replace the blanket sudoers grant on already-shipped devices (TASK-445)
KrasimirKralev
committed
d46657a
Prove the narrowed grant on a device install.sh provisioned (TASK-445)
KrasimirKralev
committed
e2277a2
Install the ollama sudo grant from the step that always runs (TASK-445)
KrasimirKralev
committed
f7662e1

Commits on Aug 26, 2026

fix: prove the allow-list landed before quarantining the blanket sudoers grant

Krasimir Kralev
and
claude
committed
d6977f8
fix: restart the Hermes gateway through systemctl and stop faking the result

Krasimir Kralev
and
claude
committed
1843dfb
docs: correct the EXEMPT_CALLS rationale for the sudo'd Hermes CLI

Krasimir Kralev
and
claude
committed
fc15707
test: sharpen the Hermes-unit sudoers tripwire instead of removing it

Krasimir Kralev
and
claude
committed
a273101

Commits on Aug 27, 2026

fix: stop the root steps running code the clawbox user can rewrite (TASK-445)
Krasimir Kralev
committed
5563de5
fix: enumerate the root-update grants instead of matching a clawbox-* prefix (TASK-445)
Krasimir Kralev
committed
6be559a
fix: start ollama through sudo during factory reset (TASK-445)
Krasimir Kralev
committed
5a93fbf
fix: parse the clawbox-writable env files instead of sourcing them as root (TASK-445)
Krasimir Kralev
committed
1e7d9db
fix: keep the root-exec record from refusing the device it protects (TASK-445)
Krasimir Kralev
committed
b71e383
fix: do not fail the granted-path audit on a grant with no snapd behind it (TASK-445)
Krasimir Kralev
committed
52c88c4
fix: hash the copy root is about to run, not the path (TASK-445)
Krasimir Kralev
committed
a9d120e
Merge pull request #495 from ID-Robots/fix/sudoers-445-followup
KrasimirKralev
authored
2e647c4
Merge pull request #502 from ID-Robots/fix/sudoers-445-root-paths
KrasimirKralev
authored
86dc561
Merge branch 'beta' into fix/hermes-sudoers-445-r2
Krasimir Kralev
committed
1a7f7b2