Bug: File Actions Can't Elevate Privileges

[rawkode]

Description Comtrya can't put files into privileged directories without running Comtrya itself as root

  - action: file.copy
    from: 1password.conf
    to: "/etc/1password/custom_allowed_browsers"

[rawkode]

There are two ways we can tackle this:

Sudo Exec

Currently, we use Rust APIs for file management. These can't elevate privileges at runtime. We'd need to start using sudo mv/cp to make this work. I am not particularly fond of this idea.

Server Mode

Comtrya was originally designed for dotfiles, but as some people wish to take on more full-system management; perhaps it is time to introduce a comtrya systemd service that runs with privileges; and we facilitate access to comtrya cli via polkit

[rawkode]

and of course, the simple option is to encourage sudo comtrya apply, but this then makes unprivileged actions/atoms run as root and provides different contexts.

I'd rather not go down this route either.

[martintc]

I am a bigger fan of the first option and just placing sudo in front since this would work universally with run0 and doas with now having privilege provider support, at least to me, easier. We could surface an is privilege and prepend the command like we do with command,run atoms.

But I do like the idea of a future comtrya service. I guess this can go back to a discussion we had awhile ago about comtrya being able to utilize push vs pull models for server/fleet management.

[martintc]

Thinking more about the server/fleet management, I can it going outside of that scope. With removing the git action, can't really use git to pull configuration, would open the door to looking at an alternative to getting manifests on a new system.

[martintc]

We will probably need to re-work the atoms unless we tell people to elevate comtrya when they run it.

[rawkode]

Running Comtrya as root or sudo is probably the answer. I was overthinking it.

[martintc]

It's all good. Just wanted to get an opinion if that is fine or if we should re-work the atoms. Really, probably wouldn't need to rework the atoms, just get rid of them and do chown and other file actions as a command.run action.