Module privilege

Expand description

Privilege escalation abstraction for sudo/doas support.

§doas capability spike (Phase 0)

Target package: opendoas (Arch: extra/opendoas) Minimum supported behavior: OpenDoas as packaged in Arch Linux repos.

Pattern	sudo	doas
Non-interactive check	`sudo -n true`	`doas -n true`
Direct command execution	`sudo <cmd>`	`doas <cmd>`
Passwordless execution	sudoers `NOPASSWD`	`permit nopass` in `/etc/doas.conf`
Password via stdin	`sudo -S` reads stdin	NOT supported
Credential refresh	`sudo -v`	NOT supported
Credential invalidation	`sudo -k`	NOT supported
Askpass env var	`SUDO_ASKPASS`	NOT supported

When doas requires a password, it prompts via its own terminal interaction.
The in-app password modal cannot be used with doas (no stdin pipe support).
Pacsea skips the password modal for doas and lets the spawned terminal handle prompting.
Credential warm-up (sudo -S -v) is unavailable for doas.
doas -n true works identically to sudo -n true for passwordless detection.

PrivilegeCapabilities: What: Capability flags describing which features a privilege tool supports.

AuthMode: What: Authentication strategy for privilege escalation.
PrivilegeMode: What: User-configured privilege tool selection mode parsed from settings.conf.
PrivilegeTool: What: Privilege escalation tool supported by Pacsea.

active_tool: What: Resolve the privilege tool using the cached application settings.
build_credential_invalidation: What: Build a credential invalidation command.
build_credential_warmup: What: Build a credential warm-up command that caches the password.
build_password_pipe: What: Build a command that pipes a password to the privilege tool via stdin.
build_privilege_command: What: Build a privilege-escalated command string.
detect_fprintd_enrolled: What: Check whether a fingerprint reader is enrolled via fprintd-list.
detect_pam_fingerprint: What: Detect whether the active privilege tool’s PAM configuration includes pam_fprintd.
is_fingerprint_available: What: Check whether fingerprint authentication appears to be available.
is_integration_test: What: Public wrapper for [is_integration_test_context].
resolve_privilege_tool: What: Resolve which privilege tool to use based on the configured mode.
run_interactive_auth: What: Run the privilege tool interactively to let the user authenticate.
validate_password: What: Validate a password against the privilege tool.