fix(install): tag the secondary installer's journalctl grants NOEXEC too

[ChuckBuilds]

Why this is a new PR

This change was reviewed and written for #472, but it never reached that PR's branch — I pushed it to a local branch that was never published, so #472 merged (fe5a3aa9) carrying only the first_time_install.sh half of the fix. scripts/install/configure_web_sudo.sh on main today still writes the untagged grants:

$WEB_USER ALL=(ALL) NOPASSWD: $JOURNALCTL_PATH -u ledmatrix.service *
$WEB_USER ALL=(ALL) NOPASSWD: $JOURNALCTL_PATH -u ledmatrix *
$WEB_USER ALL=(ALL) NOPASSWD: $JOURNALCTL_PATH -t ledmatrix *

So this re-lands it against main. My mistake, not a review miss.

The fix

configure_web_sudo.sh writes the same three wildcard journalctl grants that #472 tagged in first_time_install.sh. Each rule ends in *, so the web user controls the tail of the command line, and journalctl pages through less by default — and less will run a shell via !command. NOPASSWD:NOEXEC: stops the granted command from executing anything of its own.

All three are now NOPASSWD:NOEXEC:, matching first_time_install.sh.

Why the existing suite didn't catch it

test/test_sudoers_noexec_on_pagers.py only walked first_time_install.sh and configure_wifi_permissions.sh. configure_web_sudo.sh was simply not in INSTALLERS, so the suite was green while three untagged wildcard rules sat in it. It is now listed.

The suite also only recognised rules written literally into a heredoc — this installer echos them instead, and an echoed rule ends in a quote, so the trailing-* check skipped it and the rule was never examined at all. Echoed rules are now unwrapped before matching.

Verification

Mutation-checked — untagging the three grants fails the suite:

=== with NOPASSWD:NOEXEC: reverted to NOPASSWD: ===
FAILED test_each_journalctl_rule_is_tagged[-u ledmatrix.service]
FAILED test_each_journalctl_rule_is_tagged[-u ledmatrix]
FAILED test_each_journalctl_rule_is_tagged[-t ledmatrix]
4 failed, 3 passed

And a renamed installer path fails rather than silently dropping out of the walk (test_the_installers_are_present already covers this — I checked before adding a duplicate):

=== INSTALLERS entry pointed at a nonexistent file ===
FAILED test_the_installers_are_present

Clean: test_sudoers_noexec_on_pagers.py + test_sudo_allowlist_covers_calls.py all pass.

[coderabbitai]

Warning

Review limit reached

@ChuckBuilds, you've reached your PR review limit, so we couldn't start this review.

Next review available in:23 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d0a95382-f163-4648-bcce-a1a7c5559599

📥 Commits

Reviewing files that changed from the base of the PR and between fe5a3aa and c78e36c.

📒 Files selected for processing (2)

• scripts/install/configure_web_sudo.sh
• test/test_sudoers_noexec_on_pagers.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}