# Dashcam USB storage operations performed by the yaris-obd service while it
# runs as the unprivileged `yaris` user (modules/app_dash.py). The dashcam is
# mounted read-only by default and only remounted read-write for the brief
# duration of a validated delete operation, then restored.
#
# The mount point is fixed at /mnt/dashcam, so the mount/umount grants below are
# scoped to that directory. The `rm` grant is scoped to the `rm --` form the app
# uses after its own extension/realpath/mount-boundary validation.
yaris ALL=(root) NOPASSWD: /usr/bin/mkdir -p /mnt/dashcam
yaris ALL=(root) NOPASSWD: /usr/bin/mount -o r[ow] *
yaris ALL=(root) NOPASSWD: /usr/bin/mount -o * /mnt/dashcam
yaris ALL=(root) NOPASSWD: /usr/bin/umount /mnt/dashcam
yaris ALL=(root) NOPASSWD: /usr/bin/rm -- *