New rule: block sudo / su privilege escalation
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
Context
From Vincent's review on PR #12 — AI agents should generally never need root access. Currently we only flag sudo when combined with a dangerous deletion.
What to catch
sudo <any command>su/su -/su rootdoas(OpenBSD sudo alternative)
Considerations
- Some
sudouses might be legitimate in deployment contexts (e.g.,sudo systemctl restart nginx). - Need to decide severity:
warn(flag it, let consumers decide) vsblock(hard stop). - Could allow-list common safe patterns or use a two-tier approach (warn by default, block for destructive commands).
Origin
PR #12 review comment by @gewenyu99
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing PR #12 and its review comment, then inspect the existing rule that flags sudo only with dangerous deletion. The scope still requires a decision on severity, legitimate deployment usage, and any allow-list or two-tier behavior; the issue is done when those cases and their expected outcomes are specified and covered by the project’s relevant rule tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100