print the privileged commands with sudo where sudo is installed

The commands the "system" action prints, and the ones in the head of the
files it generates, were all "su -c '...'". On debian 13 sudo is installed
and the root account is left without a password, so those are commands
nobody can run.

as_root() now prints "sudo <cmd>" where sudo is on the path and
"su -c '<cmd>'" where it is not, which is still the way on the older
machines this has to keep working on. The one privileged command the action
runs by itself, the copy of the sysv script into /etc/init.d, goes through
sudo on the same condition.

The heads of the generated files also said "run INSTALL.sh again instead",
which stopped being true when they moved to the action: they say
"INSTALL.sh system" now.

Checked in the container: the action prints sudo for the nginx, nftables
and systemd commands, the heads of the three generated files carry the same
form, and as_root with sudo off the path falls back to su -c.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

diff --git a/INSTALL.sh b/INSTALL.sh
index 651bc93020cce8e6ca175193175a2c15124cceb2..4512f8b9fdcc253053dfb9a73d4643f2d00f2e9d 100755 (executable)
--- a/INSTALL.sh
+++ b/INSTALL.sh
@@ -205,6 +205,17 @@ function fpm_front_ports() {
     done | sort -un
 }
 
+# How to say "as root" on this machine. debian 13 installs sudo and leaves
+# the root account without a password, so a "su -c" printed there is a
+# command nobody can run; where sudo is missing, su is still the way.
+function as_root() {
+    if command -v sudo >/dev/null 2>&1; then
+        echo "sudo $1"
+    else
+        echo "su -c '$1'"
+    fi
+}
+
 # Whether this machine is run by systemd. A /etc/init.d script is of no use
 # where it is: debian 13 dropped the sysv compatibility generator, so the
 # script is never turned into a service and nothing starts it at boot.
@@ -230,9 +241,9 @@ function systemd_unit_gen() {
     cat > "$tmp" <<EOF
 # brisk ${name} - systemd unit of the brisk-spush daemon.
 # Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead.
-#   cp ${unit_f} /etc/systemd/system/${name}.service
-#   systemctl daemon-reload
-#   systemctl enable --now ${name}
+#   $(as_root "cp ${unit_f} /etc/systemd/system/${name}.service")
+#   $(as_root "systemctl daemon-reload")
+#   $(as_root "systemctl enable --now ${name}")
 
 [Unit]
 Description=Brisk daemon (${name})
@@ -311,10 +322,10 @@ function nft_conf_gen() {
     {
         echo "#!/usr/sbin/nft -f"
         echo "# brisk /${name}/ - nftables rules of the daemon machine."
-        echo "# Generated by INSTALL.sh, do not edit: run INSTALL.sh again instead."
+        echo "# Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead."
         echo "# Copy it into /etc/nftables.d/, include that directory from"
         echo '# /etc/nftables.conf (include "/etc/nftables.d/*.nft") and load it:'
-        echo "#   nft -c -f /etc/nftables.d/${name}.nft && nft -f /etc/nftables.d/${name}.nft"
+        echo "#   $(as_root "nft -c -f /etc/nftables.d/${name}.nft") && $(as_root "nft -f /etc/nftables.d/${name}.nft")"
         echo "#"
         echo "# The table accepts by default and drops only the ports of brisk. With a"
         echo "# firewall whose policy is drop, an accept here is not enough: the two"
@@ -398,8 +409,8 @@ function nginx_conf_gen() {
     tmp="$(mktemp)"
     {
         echo "# brisk ${pfx}/ - nginx, http level. Generated by INSTALL.sh, do not edit:"
-        echo "# run INSTALL.sh again instead. Include it at http level, for example"
-        echo "#   ln -s $http_f /etc/nginx/conf.d/"
+        echo "# run "INSTALL.sh system" again instead. Include it at http level, for example"
+        echo "#   $(as_root "ln -s $http_f /etc/nginx/conf.d/")"
         echo
         echo "map \$http_upgrade \$${var}_connection_upgrade {"
         echo "    default upgrade;"
@@ -429,7 +440,7 @@ function nginx_conf_gen() {
     tmp="$(mktemp)"
     cat > "$tmp" <<EOF
 # brisk ${pfx}/ - directives of every url served by the daemon.
-# Generated by INSTALL.sh, do not edit: run INSTALL.sh again instead.
+# Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead.
 # brisk is a comet application: the response of index_rd.php is a stream
 # that stays open for hours, none of these lines is decorative.
 
@@ -463,7 +474,7 @@ EOF
     tmp="$(mktemp)"
     {
         echo "# brisk ${pfx}/ - nginx, inside the server {} that terminates the tls."
-        echo "# Generated by INSTALL.sh, do not edit: run INSTALL.sh again instead."
+        echo "# Generated by INSTALL.sh, do not edit: run "INSTALL.sh system" again instead."
         echo "#   server {"
         echo "#       listen 443 ssl;"
         echo "#       ..."
@@ -776,9 +787,9 @@ if [ "$action" = "system" ]; then
     else
         echo "nginx configuration:"
         nginx_conf_gen
-        sys_todo="${sys_todo}  su -c 'ln -s $etc_path/nginx-${scrname}.conf /etc/nginx/conf.d/'\n"
+        sys_todo="${sys_todo}  $(as_root "ln -s $etc_path/nginx-${scrname}.conf /etc/nginx/conf.d/")\n"
         sys_todo="${sys_todo}  include $etc_path/nginx-${scrname}-server.conf  inside the server {} of the site\n"
-        sys_todo="${sys_todo}  su -c 'nginx -t' && su -c 'systemctl reload nginx'\n"
+        sys_todo="${sys_todo}  $(as_root "nginx -t") && $(as_root "systemctl reload nginx")\n"
     fi
 
     # --- nftables ---
@@ -791,8 +802,8 @@ if [ "$action" = "system" ]; then
     else
         echo "nftables rules:"
         nft_conf_gen
-        sys_todo="${sys_todo}  su -c 'cp $etc_path/${scrname}.nft /etc/nftables.d/'\n"
-        sys_todo="${sys_todo}  su -c 'nft -c -f /etc/nftables.d/${scrname}.nft' && su -c 'nft -f /etc/nftables.d/${scrname}.nft'\n"
+        sys_todo="${sys_todo}  $(as_root "cp $etc_path/${scrname}.nft /etc/nftables.d/")\n"
+        sys_todo="${sys_todo}  $(as_root "nft -c -f /etc/nftables.d/${scrname}.nft") && $(as_root "nft -f /etc/nftables.d/${scrname}.nft")\n"
     fi
 
     # --- how the daemon is started ---
@@ -801,18 +812,22 @@ if [ "$action" = "system" ]; then
     elif has_systemd; then
         echo "systemd unit:"
         systemd_unit_gen
-        sys_todo="${sys_todo}  su -c 'cp $etc_path/${scrname}.service /etc/systemd/system/'\n"
-        sys_todo="${sys_todo}  su -c 'systemctl daemon-reload'\n"
-        sys_todo="${sys_todo}  su -c 'systemctl enable --now ${scrname}'\n"
+        sys_todo="${sys_todo}  $(as_root "cp $etc_path/${scrname}.service /etc/systemd/system/")\n"
+        sys_todo="${sys_todo}  $(as_root "systemctl daemon-reload")\n"
+        sys_todo="${sys_todo}  $(as_root "systemctl enable --now ${scrname}")\n"
     else
         # No systemd: the sysv script is what starts the daemon, and this is
         # the one file the action installs itself, as it always has.
         cp bin/brisk-init.sh brisk-init.sh.wrk
         sed -i "s@^BPATH=.*@BPATH=\"${web_path}\"@g;s@^PPATH=.*@PPATH=\"${legal_path}\"@g;s@^SSUFF=.*@SSUFF=\"${scrname}\"@g;s@^BUSER=.*@BUSER=\"${sys_user}\"@g" brisk-init.sh.wrk
-        su -c "cp brisk-init.sh.wrk /etc/init.d/${scrname}"
+        if command -v sudo >/dev/null 2>&1; then
+            sudo cp brisk-init.sh.wrk "/etc/init.d/${scrname}"
+        else
+            su -c "cp brisk-init.sh.wrk /etc/init.d/${scrname}"
+        fi
         rm brisk-init.sh.wrk
         echo "sysv script installed as /etc/init.d/${scrname}"
-        sys_todo="${sys_todo}  su -c 'update-rc.d $scrname defaults'\n"
+        sys_todo="${sys_todo}  $(as_root "update-rc.d $scrname defaults")\n"
     fi
 
     echo

diff --git a/WARNING.txt b/WARNING.txt
index 2d7d94a97d7327befc35b4b78a1ff084c0c1d772..b79560a54a3f6fdf17f79362e44bfd2e6e246053 100644 (file)
--- a/WARNING.txt
+++ b/WARNING.txt
@@ -113,9 +113,13 @@ Where systemd is in charge the action writes a unit instead, in Etc as
 <name>.service beside the other generated files, and leaves /etc/init.d
 alone. It is only written: copy it, reload, enable.
 
-    su -c 'cp <Etc>/brisk.service /etc/systemd/system/'
-    su -c 'systemctl daemon-reload'
-    su -c 'systemctl enable --now brisk'
+    sudo cp <Etc>/brisk.service /etc/systemd/system/
+    sudo systemctl daemon-reload
+    sudo systemctl enable --now brisk
+
+(the action prints these with sudo where sudo is installed, with su -c where
+it is not: debian 13 installs sudo and leaves root without a password, so a
+su -c printed there is a command nobody can run)
 
 Without systemd nothing changes: the sysv script is installed as before.