[djbclark]

What

Closes the two residual LOW findings (N1, N2) from the Linux/NixOS port adversary review — both were flagged as "wrong statements in security-relevant prose".

• N1 (nix/module.nix): the security.sudo.extraConfig assignment was a bare builtins.readFile, so the module-system ordering comment was wrong about where its line lands. Now wrapped as lib.mkAfter (builtins.readFile sudoersText) so it sorts after any default-priority extraConfig definer, and the comment states the actual mechanism (sortProperties runs when any definition carries _type == "order").
• N2 (docs/design/dann-deployment-threat-model.md): the SETENV clause now states the last-match-wins reading precisely — the module's broker line matches last and carries no SETENV, so sudo VAR=… -u <svc> $BROKER … is refused, while the wheel rule's SETENV still covers sudo -u <svc> env VAR=… $BROKER ….

One commit, two files. No policy text, grants, Defaults!, paths, or permissions changed.

Adversary verdict

Reviewed by adversary (head 052023dc11e79eff1686ee3b9032f8e988592da6):

VERDICT: APPROVE. N1 and N2 are both closed, with correct semantics checked against current nixpkgs source. The
lib.mkAfter wrap introduces no regression and widens nothing.

Both N1 and N2 closed; two INFO notes (an env_keep nuance on "is refused" wording, and a pre-existing test.nix comment inaccuracy outside the delta) were treated as non-blocking.

---

Note

Low Risk
Documentation and Nix merge ordering only; emitted sudoers policy is unchanged and adversary review reported no regression or privilege widening.

Overview
Closes adversary review items N1 and N2 by fixing security-relevant prose and NixOS merge behavior—no sudoers grants, paths, or permissions change.

Nix module: security.sudo.extraConfig is now lib.mkAfter (builtins.readFile sudoersText) so the module’s policy sorts after other modules’ extraConfig lines (via sortProperties when ordering metadata is present). The inline comment no longer claims mkOrder/mkAfter are ignored on types.lines; it documents the real ordering story and the residual availability-only conflict if another module also uses mkAfter.

Threat model (dann): The SETENV / last-match-wins bullet is rewritten so the module’s broker rule (last match, no SETENV) refuses sudo VAR=… -u <svc> $BROKER …, while %wheel’s SETENV still allows sudo -u <svc> env VAR=… $BROKER …—clarifying which injection shape remains on a root-equivalent host.

^{Reviewed by Cursor Bugbot for commit 052023d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: b56226d0-306c-43b4-844b-15d2d78c8011)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T10:43:51.008299Z	052023d	PR opened
🔒 Security Review	✅ Completed 2026-10-29T10:46:12.888598Z	052023d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[linear-code]

VIB-165