wehub-resource-sync
426e9eeabd
Benchmark Bridge Tests / benchmark (bunx @biomejs/biome check packages/lifeops-bench/src, benchmark-lint) (push) Waiting to run
Benchmark Bridge Tests / benchmark (bunx vitest run --config packages/lifeops-bench/vitest.config.ts --root packages/lifeops-bench --passWithNoTests, benchmark-tests) (push) Waiting to run
Build Agent Image / build-and-push (push) Waiting to run
Chat shell gestures / Chat shell gesture + parity e2e (push) Waiting to run
ci / test (push) Waiting to run
ci / lint-and-format (push) Waiting to run
ci / build (push) Waiting to run
ci / dev-startup (push) Waiting to run
Cloud Gateway Discord / Test (push) Waiting to run
Cloud Gateway Webhook / Test (push) Waiting to run
Cloud Tests / lint-and-types (push) Waiting to run
Cloud Tests / unit-tests (push) Waiting to run
Cloud Tests / integration-tests (push) Waiting to run
Cloud Tests / e2e-tests (push) Blocked by required conditions
CodeQL Advanced / Analyze (javascript-typescript) (push) Waiting to run
Deploy Apps Worker (Product 2) / Determine environment (push) Waiting to run
Deploy Apps Worker (Product 2) / Deploy apps worker to apps-control host (${{ needs.determine-env.outputs.environment }}) (push) Blocked by required conditions
Deploy Eliza Provisioning Worker / Determine environment (push) Waiting to run
Deploy Eliza Provisioning Worker / Deploy worker to Hetzner host (${{ needs.determine-env.outputs.environment }} @ ${{ needs.determine-env.outputs.deployment_sha }}) (push) Blocked by required conditions
Dev Smoke / Classify changed paths (push) Waiting to run
Dev Smoke / bun run dev onboarding chat (push) Blocked by required conditions
Dev Smoke / Vite HMR dependency-level smoke (push) Blocked by required conditions
Electrobun Submodule Guard / electrobun gitlink is fetchable (push) Waiting to run
gitleaks / gitleaks (push) Waiting to run
Markdown Links / Relative Markdown Links (push) Waiting to run
Publish @elizaos/example-code / check_npm (push) Waiting to run
Publish @elizaos/example-code / publish_npm (push) Blocked by required conditions
Publish @elizaos/plugin-elizacloud / verify_version (push) Waiting to run
Publish @elizaos/plugin-elizacloud / publish_npm (push) Blocked by required conditions
Quality (Extended) / Homepage Build (PR smoke) (push) Waiting to run
Quality (Extended) / Comment-only diff guard (push) Waiting to run
Quality (Extended) / Format + Type Safety Ratchet (push) Waiting to run
Quality (Extended) / Develop Gate (secret scan + UI determinism) (push) Waiting to run
Quality (Extended) / Develop Gate (lint) (push) Waiting to run
Sandbox Live Smoke / Sandbox live smoke (push) Waiting to run
Snap Build & Test / Build Snap (amd64) (push) Waiting to run
Snap Build & Test / Build Snap (arm64) (push) Waiting to run
supply-chain / sbom (push) Waiting to run
supply-chain / vulnerability-scan (push) Waiting to run
Build, Push & Deploy to Phala Cloud / build-and-push (push) Waiting to run
Test Packaging / Validate Packaging Configs (push) Waiting to run
Test Packaging / PyPI on Python ${{ matrix.python }} (push) Waiting to run
Test Packaging / Pack & Test JS Tarballs (push) Waiting to run
Test Packaging / elizaos CLI global-install smoke (node + bun) (push) Waiting to run
UI Fixture E2E / ui-fixture-e2e (push) Waiting to run
UI Fixture E2E / fixture-e2e (push) Waiting to run
UI Story Gate / story-gate (push) Waiting to run
vault-ci / test (macos-latest) (push) Waiting to run
vault-ci / test (ubuntu-latest) (push) Waiting to run
vault-ci / test (windows-latest) (push) Waiting to run
vault-ci / app-core wiring tests (push) Waiting to run
verify-patches / verify patches/CHECKSUMS.sha256 (push) Waiting to run
Voice Benchmark Smoke / voice-emotion fixture smoke (push) Waiting to run
Voice Benchmark Smoke / voiceagentbench fixture smoke (push) Waiting to run
Voice Benchmark Smoke / voicebench-quality unit smoke (push) Waiting to run
Voice Benchmark Smoke / voicebench TypeScript unit (no audio) (push) Waiting to run
Voice Benchmark Smoke / voice bench smoke summary (push) Blocked by required conditions
Windows CI / windows ([bun run --cwd packages/app-core test bun run --cwd packages/elizaos test bun run --cwd packages/cloud/shared test], app-and-cli) (push) Waiting to run
Windows CI / windows ([bun run --cwd packages/scenario-runner test bun run --cwd packages/vault test bun run --cwd packages/security test bun run --cwd plugins/plugin-coding-tools test], framework-packages) (push) Waiting to run
Windows CI / windows ([bun run --cwd plugins/plugin-elizacloud test bun run --cwd plugins/plugin-discord test bun run --cwd plugins/plugin-anthropic test bun run --cwd plugins/plugin-openai test bun run --cwd plugins/plugin-app-control test bun run --cwd plugins/pl… (push) Waiting to run
Windows CI / windows ([node packages/scripts/run-turbo.mjs run build --filter=@elizaos/core --filter=@elizaos/shared --filter=@elizaos/agent --concurrency=4 node packages/scripts/run-bash-linux-only.mjs scripts/verify-riscv64-buildpaths.sh node packages/scripts/run… (push) Waiting to run
Windows CI / windows ([node packages/scripts/run-turbo.mjs run typecheck --filter=@elizaos/core --filter=@elizaos/shared --filter=@elizaos/cloud-shared --concurrency=4 bun run --cwd packages/core test bun run --cwd packages/shared test], core-runtime, 75) (push) Waiting to run
Test Packaging / Build & Test PyPI Package (push) Waiting to run
Voice Workbench / headless workbench (mocked backends) (push) Has been cancelled
Voice Workbench / real acoustic lane (nightly, provisioned only) (push) Has been cancelled
4.3 KiB
4.3 KiB
Inherited Tails Sudoers Review
Date: 2026-05-17
Scope: broad sudoers rules inherited from the Tails base that are still present in the elizaOS Live overlay. This review does not bless broad root for the elizaOS app. It records which inherited Tails rules are accepted for Tails feature parity and which mitigations must stay in place.
Decision
elizaOS Live accepts the inherited Tails sudoers rules listed below for the demo and release-candidate path because they back existing Tails features: Greeter, Persistent Storage, Tor Browser, Tails Upgrader, and WhisperBack.
elizaOS-owned policy remains stricter:
- no elizaOS sudoers file may use
ALL,NOPASSWD: ALL, arbitrary arguments, package managers, service managers, mount tools, disk writers, or shells - the app runs as
amnesia, not root - root crossing for elizaOS features stays behind
/usr/local/lib/elizaos/capability-runner - the current elizaOS broker sudoers entry allows only
root-status
Any new broad sudoers rule outside this reviewed list is a security failure.
Reviewed Rules
| File | User | Command | Purpose | Risk | Decision |
|---|---|---|---|---|---|
tails-greeter-cryptsetup.toml |
Debian-gdm |
/sbin/cryptsetup with arbitrary arguments |
Lets the Tails Greeter unlock Persistent Storage before the live session starts. | Greeter compromise could invoke cryptsetup broadly. | Accept inherited rule; do not expose it to elizaOS app code. |
tails-greeter-umount.toml |
Debian-gdm |
/bin/umount with arbitrary arguments |
Lets the Tails Greeter cleanly unmount Persistent Storage devices during setup/error handling. | Greeter compromise could unmount arbitrary paths. | Accept inherited rule; keep it Greeter-only. |
tbb.toml |
amnesia |
/usr/local/lib/tails-run-tor-browser-in-flatpak with ENVFILE |
Preserves Tails Tor Browser launch path. | Wrapper argument validation is trusted; bad wrapper validation could widen browser launch control. | Accept inherited rule; elizaOS must not reuse it for app launch. |
tps.toml |
amnesia, tails-persistent-storage |
Tails Persistent Storage frontend/service commands, including a privileged internal NOPASSWD: ALL bridge from tails-persistent-storage to amnesia |
Keeps Tails Persistent Storage working. elizaOS data persistence is implemented as a native TPS feature. | This is the broadest inherited rule and requires upstream TPS trust. | Accept inherited rule for Tails parity; elizaOS adds only bounded TPS bindings and no whole-home or system persistence. |
upgrade.toml |
amnesia, tails-upgrade-frontend, tails-install-iuk |
Tails signed Incremental Upgrade Kit flow, including internal ALL for the installer user |
Preserves inherited IUK plumbing for future base-OS update compatibility. The automatic unit is gated by /etc/elizaos/base-updates-enabled until elizaOS owns the feed and signing process. |
Updater compromise has high impact. | Accept inherited rule only as reviewed upstream plumbing; elizaOS app/runtime updates use separate signed manifests and must not bypass this review for OS/base updates. |
whisperback.toml |
amnesia |
/usr/local/bin/whisperback with arbitrary arguments |
Preserves inherited bug-reporting UX. | Wrapper argument validation is trusted; reports can contain sensitive data if user includes it. | Accept inherited rule; elizaOS should replace or constrain support reporting before enterprise release. |
Mitigations
scripts/security-smoke.shfails on any broad elizaOS-owned sudoers rule.scripts/security-smoke.shfails on any unexpected broad inherited sudoers rule not listed here.- elizaOS persistence is implemented through bounded TPS bindings only.
- The app supervisor starts user services; it does not run the app as root.
- The update-manager never executes user-writable staged runtimes directly.
- Stable enterprise release still needs an external AppArmor, polkit, sudoers, systemd, and update-path audit.
Production Follow-Up
Before a public enterprise release, decide whether to:
- keep these inherited rules unchanged and explicitly document Tails as the trusted base,
- carry a smaller downstream Tails policy patch,
- or upstream tighter argument validation to Tails.
Do not remove these rules casually. They are part of core Tails behavior, and breaking them can break Persistent Storage, Greeter, Tor Browser, upgrades, or support reporting.