From 1681ce567ef3b08de4d38323c8eb93185d1ad540 Mon Sep 17 00:00:00 2001
From: nesquena-hermes <nesquena-hermes@users.noreply.github.com>
Date: Sat, 9 May 2026 19:23:54 +0000
Subject: [PATCH] =?UTF-8?q?fix(start.sh):=20NOPASSWD=20precheck=20on=20roo?=
 =?UTF-8?q?t=20re-exec=20=E2=80=94=20silent=20fall-through?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per Opus advisor on PR #1969: the original three-guard root re-exec
(EUID==0, hermeswebui exists, sudo on PATH) would exit non-zero with
`sudo: a password is required` on host machines where the developer's
hermeswebui user doesn't have NOPASSWD configured.

Better failure mode: silent fall-through to running as root (back to
pre-PR behavior). Adds a fourth guard `sudo -n -u hermeswebui true 2>/dev/null`
that pre-flights the sudo capability without producing visible output.

Also expands the comment to clarify which guard is load-bearing on the
canonical container path (the production image doesn't ship sudo at all,
so `command -v sudo` is the silent-no-op gate there; the entrypoint
docker_init.bash never invokes start.sh in any case).

No new tests needed — existing behavioral tests already cover the
non-root + non-sudo paths, which is what runs in CI and on host.
---
 start.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/start.sh b/start.sh
index 5de36a20..a1406663 100755
--- a/start.sh
+++ b/start.sh
@@ -9,8 +9,20 @@ set -euo pipefail
 # Sourced from PR #1686 (@binhpt310) — Cluster 1 (operational hardening),
 # extracted to a focused follow-up after the parent PR was deferred over a
 # separate sibling-repo build-context concern unrelated to this fix.
+#
+# Four preconditions to fire (all must hold):
+#   - EUID == 0
+#   - hermeswebui user actually exists (id lookup)
+#   - sudo is on PATH (production image does not ship sudo, so this is the
+#     load-bearing no-op guard for the canonical container path)
+#   - sudo -u hermeswebui passes without prompting (NOPASSWD precheck)
+# The NOPASSWD precheck via `sudo -n -u hermeswebui true` makes this a silent
+# fall-through on host machines where the developer's hermeswebui user
+# requires a password — better than exiting non-zero with `sudo: a password
+# is required` and surprising the user who didn't ask for sudo behavior.
 if [[ ${EUID:-$(id -u)} -eq 0 ]] && id hermeswebui >/dev/null 2>&1 \
-        && command -v sudo >/dev/null 2>&1; then
+        && command -v sudo >/dev/null 2>&1 \
+        && sudo -n -u hermeswebui true 2>/dev/null; then
   exec sudo -n -u hermeswebui "$0" "$@"
 fi