harden: cap malloc arenas, warn on unit drift, and grant the portal's sudo commands - #476

Merged

ChuckBuilds merged 6 commits into

mainfrom

harden/install-and-systemd

Aug 21, 2026

Commits on Aug 20, 2026

perf(systemd): cap glibc malloc arenas on the display service
ChuckBuilds
committed
9a759ee
test(systemd): pin the arena value instead of accepting a range
ChuckBuilds
committed
f7046f8
fix(startup): warn when an installed systemd unit has drifted from the repo's
ChuckBuilds
committed
e1b4452
fix(install): grant the sudo commands the captive portal actually runs
ChuckBuilds
committed
324a4e4
fix(install): drop the iptables wildcard, and pin each grant properly
ChuckBuilds
committed
61d3e3d

Commits on Aug 21, 2026

fix(install): pin PATH, keep unit order, and tighten the sudoers assertions

ChuckBuilds
and
claude
committed
e36e050