14 lines
791 B
Plaintext
14 lines
791 B
Plaintext
# Dashcam USB storage operations performed by the yaris-obd service while it
|
|
# runs as the unprivileged `yaris` user (modules/app_dash.py). The dashcam is
|
|
# mounted read-only by default and only remounted read-write for the brief
|
|
# duration of a validated delete operation, then restored.
|
|
#
|
|
# The mount point is fixed at /mnt/dashcam, so the mount/umount grants below are
|
|
# scoped to that directory. The `rm` grant is scoped to the `rm --` form the app
|
|
# uses after its own extension/realpath/mount-boundary validation.
|
|
yaris ALL=(root) NOPASSWD: /usr/bin/mkdir -p /mnt/dashcam
|
|
yaris ALL=(root) NOPASSWD: /usr/bin/mount -o r[ow] *
|
|
yaris ALL=(root) NOPASSWD: /usr/bin/mount -o * /mnt/dashcam
|
|
yaris ALL=(root) NOPASSWD: /usr/bin/umount /mnt/dashcam
|
|
yaris ALL=(root) NOPASSWD: /usr/bin/rm -- *
|