Skip to content

root-maintenance — how a root-level change gets made from Claude Code

The workflow that worked for hardening items 06–13. Agents pre-flight and stage; a scoped grant covers exactly the binaries the task needs; the main session verifies every number before the next gate; firmware and fstab writes are handed to the user; the grant is revoked at the end.

Input → Movement → Output

Input: a task with a known blast radius. Movement: pre-flight (read-only) → grant → staged execution with a verification gate after each step → user-run lines for anything the classifier blocks → revoke → update the card. Output: the change, its evidence, and the map kept true.

Why this shape

The user wants agents to do the work, supervised, on a live array where "make sure nothing breaks" is the requirement. A blanket NOPASSWD is the wrong tool; a grant that names tee by its exact argument is auditable and revocable.

Steps

  1. Pre-flight read-only (subagents are fine here). Write down the numbers you will check afterwards.
  2. Hand the user one line: ! printf 'angel ALL=(root) NOPASSWD: /usr/bin/<bin> [args], …, /usr/bin/rm /etc/sudoers.d/90-claude-maintenance\n' | sudo tee /etc/sudoers.d/90-claude-maintenance >/dev/null && sudo chmod 0440 /etc/sudoers.d/90-claude-maintenance && sudo visudo -cf /etc/sudoers.d/90-claude-maintenance Restrict tee/cp/mount by argument. Always include the rm of the grant itself.
  3. Execute from the main session — the auto-mode classifier blocks root writes from subagents (launching snapraid sync, cp to /etc/fstab) and firmware writes (idle3ctl -d) even from the main session: give those as ! sudo … lines and verify the read-back yourself.
  4. Verify each step independently before the next (e.g. remount before tune2fs so /proc/mounts shows the option took; findmnt --verify on a staged fstab; daemon-reload after unit edits).
  5. Long jobs (a 49-minute sync): foreground, or run_in_background knowing the memory supervisor may kill it — prefer the systemd unit (sr).
  6. Revoke: ! sudo rm /etc/sudoers.d/90-claude-maintenance. Confirm with sudo -n -l. (Forgetting this step once left the 09-03 grant live for five days.)
  7. Update the relevant card(s) and the hardening-plan status; run map/_meta/build-index.sh.

If you change this

  • Hits: every future root task; the memory file plex-server-root-workflow.md (points here).
  • Does not hit: container work — angel is in the docker group.

See

  • Objects: sudo-and-tools
  • Source: /etc/sudoers.d/ · memory plex-server-root-workflow.md