🛡️ sudo-leash

Temporary, visible and automatically expiring sudo access.
Built for local development tools and AI coding agents on Linux.

sudo-leash puts privileged access on a short, visible timer. Its Quickshell button turns into an animated red countdown while the lease is active, and a systemd timer revokes the lease even if the UI or client disappears.

Important

This is a time and command gate, not an AI identity boundary. Linux sees Codex, Claude Code, terminals and editors running as the same Unix user. Every process owned by that user can exercise an active lease. Read the security model before enabling full-access mode.

At a glance

	Capability
⏱️	Leases expire automatically after 60–3600 seconds
✅	Exact command-and-argument allowlisting is the safe default
🔐	Enabling requires human authentication through polkit
🧯	Disabling is instant and never requires a password
🧹	Active rules and state live under /run and vanish on reboot
🧾	Install, enable, disable and expiry events go to the journal
🎛️	Includes a themed toggle for the Illogical Impulse ii bar

Quick start

1. Install the safe default

git clone https://github.com/onderaktas54/sudo-leash.git
cd sudo-leash
./scripts/install.sh

The default lease lasts ten minutes and grants only exact commands from the root-owned allowlist. The included example permits sudo id as a harmless test.

2. Choose the commands

sudoedit /etc/sudo-leash/allowlist

Each entry includes the executable's absolute path and its exact arguments:

/usr/bin/pacman -Syu
/usr/bin/systemctl restart NetworkManager.service

Commands without arguments must explicitly use "":

/usr/bin/id ""

3. Use the shield or CLI

sudo-leash status
sudo-leash enable
sudo-leash disable
sudo-leash toggle

Enabling opens the desktop authentication dialog. The permanent passwordless control rule can only check or revoke a lease—it cannot create or extend one.

How it works

Quickshell / CLI
      │
      ├── enable ── polkit authentication ──┐
      ├── status ── passwordless control ───┤
      └── disable ─ passwordless control ───┤
                                            ▼
                                     root-owned helper
                                      │      │      │
                                sudoers   state   timer
                                  /run    /run   systemd

The helper writes an atomic, visudo-validated rule under /run, records the exact expiry token, and starts a transient systemd timer. A stale timer cannot revoke a newer lease. See Architecture for the complete flow.

Configuration

Use a five-minute lease:

./scripts/install.sh --duration 300

Install without Quickshell integration:

./scripts/install.sh --no-widget

The automatic widget integration targets:

~/.config/quickshell/ii/modules/ii/bar/BarContent.qml

Other panels can use the CLI or adapt quickshell/SudoLeashToggle.qml.

Full-access mode

Caution

Full mode temporarily creates NOPASSWD: ALL. During that window, compromise of any process under your user account is equivalent to root compromise.

Full mode is deliberately explicit and requires typing FULL during install:

./scripts/install.sh --full-access --duration 300

Audit and removal

View lifecycle events:

journalctl -t sudo-leash

Remove the helper, rules, CLI and widget:

./scripts/uninstall.sh

Development

Run the same static checks used by CI:

./tests/test.sh

The suite checks Bash syntax, validates representative sudoers rules, and uses ShellCheck and qmllint when available. Contributions are welcome—see CONTRIBUTING.md.

License

MIT