The current NetworkManager implementation no longer uses a sudoers rule and appears to have fixed the underlying problem in 4dca506. Thank you for making that change.
A historical marketplace backtest found that the originally listed commit (e33ca549) instructed users to create:
$USER ALL=(ALL:ALL) NOPASSWD: /usr/bin/wg, /usr/bin/wg-quick
Because wg-quick executes PreUp, PostUp, PreDown, and PostDown directives from user-controlled configuration files, a leftover rule permits passwordless root command execution. Updating the plugin does not remove /etc/sudoers.d/wireguard-omarchy, and the earlier migration section is no longer present in the current README.
Would you consider:
- restoring a visible legacy security/migration notice;
- warning when the stale file is detected, without deleting it automatically;
- documenting the cleanup and validation commands:
sudo rm -f /etc/sudoers.d/wireguard-omarchy
sudo visudo -c
This is a legacy-installation cleanup request; the current NetworkManager backend itself is not affected.
The current NetworkManager implementation no longer uses a sudoers rule and appears to have fixed the underlying problem in
4dca506. Thank you for making that change.A historical marketplace backtest found that the originally listed commit (
e33ca549) instructed users to create:Because
wg-quickexecutesPreUp,PostUp,PreDown, andPostDowndirectives from user-controlled configuration files, a leftover rule permits passwordless root command execution. Updating the plugin does not remove/etc/sudoers.d/wireguard-omarchy, and the earlier migration section is no longer present in the current README.Would you consider:
This is a legacy-installation cleanup request; the current NetworkManager backend itself is not affected.