Security-review the one-time privileged diagnostic authorization broker

[deucebucket]

Current prototype

This branch adds a one-time interactive installer, root-owned checksummed DeckDoc snapshot, exact sudoers command allowlist, and an unprivileged client that uses sudo -n. Remediation and arbitrary arguments/paths are excluded.

Scope

Threat-model and harden this path before recommending it broadly or allowing diagnostic agents to use it.

Acceptance criteria

• Independently review sudoers argument matching, environment handling, symlinks, TOCTOU, ownership/modes, PATH, shell startup variables, output handling, and concurrent reports.
• Broker accepts only documented argument-free operations and rejects extra arguments.
• The authorized snapshot is root-owned and integrity-checked before execution.
• Repository updates cannot alter privileged code until the owner explicitly reinstalls.
• No password, arbitrary root shell/command/path/environment, package install, or remediation is delegated.
• Reports land in user-owned private files without accepting a privileged output path.
• Install/update/revoke/purge are explicit, auditable, and tested on SteamOS sudo/visudo.
• Add automated adversarial tests and document residual risk.

Non-goals

Do not add a generic privileged RPC endpoint or password storage. State-changing fixes require separate, fresh authorization.

Docs

docs/wiki/Privileged-Diagnostic-Authorization.md