From 9e946a8a45c23a72d7a55e4ca37360ab84f963cc Mon Sep 17 00:00:00 2001
From: Matthias Lucas Jaros <jarlucmat@mailbox.org>
Date: Mon, 20 Oct 2025 20:52:07 +0200
Subject: Restrict sudo to specific group

---
 src/init | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'src/init')

diff --git a/src/init b/src/init
index 9c4107d..619c97e 100755
--- a/src/init
+++ b/src/init
@@ -31,6 +31,8 @@ function createUser
 	# user is not restricted, this is done in ssh config with forceCommand
 	# we need to be able to run a fish script to check for permissions
 	adduser --home $HOME -D "$user"
+	# add user to sudo group
+	addgroup "$user" $_GIT_SUDO_GROUP
 	# unlock account to allow ssh logins
 	passwd -u "$user"
 	mkdir "$HOME/.ssh"
@@ -45,6 +47,8 @@ function setupGitUser
 	# git user has read/write access to all repos, set git-shell
 	# and no password login allowed -> no ssh login possible
 	adduser git -u $GIT_UID -D --shell "/usr/bin/git-shell"
+	# group that is allowed to sudo
+	addgroup $_GIT_SUDO_GROUP
 end
 
 function setupRepo
-- 
cgit v1.3.1