Skip to content

Document limited sudo access configuration #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
theelderemo merged 1 commit into from
Oct 20, 2025
Merged

Document limited sudo access configuration #15

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 59 additions & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,55 @@ Configuration

### Configuration

## Configuring Limited Sudo Access (Optional)

CortexAI operates with the privileges of the user running it. For certain tasks, like installing necessary tools or performing specific types of network scans, it might require elevated (`sudo`) privileges. To avoid needing to enter your password repeatedly and to limit the agent's root access, you can configure passwordless `sudo` for *specific* commands only.

> [!WARNING]
> **Critical Warning:** Modifying sudo permissions is a sensitive operation. Incorrect configuration can compromise your system's security or lock you out. **Never** edit /etc/sudoers directly. Always use the visudo command, which performs syntax checks before saving:

```bash
sudo visudo
```
Granting Specific Passwordless Permissions
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The heading 'Granting Specific Passwordless Permissions' on line 131 is not formatted as a markdown heading. It should use markdown heading syntax (e.g., '### Granting Specific Passwordless Permissions') to maintain proper document structure and hierarchy.

Suggested change
Granting Specific Passwordless Permissions
### Granting Specific Passwordless Permissions

Copilot uses AI. Check for mistakes.
Identify Required Commands: Determine the exact commands CortexAI might need sudo for (e.g., systemctl start <service>, specific nmap options). Be as specific as possible.

Edit Sudoers: Add a line in visudo for the user running CortexAI (replace cortexuser with the actual username YOU CREATE).

Allow cortexuser to run specific commands without a password for CortexAI
```
cortexuser ALL=(ALL) NOPASSWD: /usr/bin/specific/command1, /usr/bin/another/command --with-options *
cortexuser: The username running CortexAI.
```
Comment on lines +136 to +140
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment on line 136 should be inside the code block as a comment (prefixed with #), and the explanation on line 139 should be outside the code block. The current structure incorrectly places explanatory text inside a code block that's meant to show sudoers file syntax.

Suggested change
Allow cortexuser to run specific commands without a password for CortexAI
```
cortexuser ALL=(ALL) NOPASSWD: /usr/bin/specific/command1, /usr/bin/another/command --with-options *
cortexuser: The username running CortexAI.
```

Allow cortexuser to run specific commands without a password for CortexAI

cortexuser ALL=(ALL) NOPASSWD: /usr/bin/specific/command1, /usr/bin/another/command --with-options *

cortexuser: The username running CortexAI.

Copilot uses AI. Check for mistakes.

ALL=(ALL): Allows running on this host, usually as root.

NOPASSWD:: Enables passwordless execution for the listed commands.
Comment on lines +142 to +144
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These explanatory bullet points lack proper markdown list formatting. They should use markdown list syntax (e.g., '- ALL=(ALL): ...') to improve readability and document structure.

Copilot uses AI. Check for mistakes.

/usr/bin/specific/command1: Use the full path to the command. You can find this using which <command>.

Separate multiple commands with commas. You can use wildcards (*) but do so with extreme caution.

Restricting Dangerous Commands
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The heading 'Restricting Dangerous Commands' on line 150 is not formatted as a markdown heading. It should use markdown heading syntax (e.g., '### Restricting Dangerous Commands') to maintain proper document structure and hierarchy.

Suggested change
Restricting Dangerous Commands
### Restricting Dangerous Commands

Copilot uses AI. Check for mistakes.
You can also explicitly deny the user from running certain dangerous commands with sudo, even if broader permissions might otherwise allow them. Add these after the NOPASSWD line:

Deny dangerous commands for cortexuser even with sudo
```
cortexuser ALL=(ALL) !/usr/bin/rm *, !/usr/sbin/shutdown, !/usr/sbin/reboot, !/usr/bin/passwd, !/usr/bin/cat /path/to/your/secure/files/*
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sudo deny rule '!/usr/bin/rm *' is ineffective because the wildcard doesn't work as intended in sudoers syntax. The rule should be '!/usr/bin/rm' without the wildcard, or use '/usr/bin/rm *' within quotes. Additionally, deny rules in sudoers are evaluated differently than allow rules, and this configuration may not provide the intended protection.

Suggested change
cortexuser ALL=(ALL) !/usr/bin/rm *, !/usr/sbin/shutdown, !/usr/sbin/reboot, !/usr/bin/passwd, !/usr/bin/cat /path/to/your/secure/files/*
cortexuser ALL=(ALL) !/usr/bin/rm, !/usr/sbin/shutdown, !/usr/sbin/reboot, !/usr/bin/passwd, !/usr/bin/cat /path/to/your/secure/files/*

Copilot uses AI. Check for mistakes.
```
The ! negates the permission for the specified command.
Comment on lines +153 to +157
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment on line 153 should be inside the code block as a comment (prefixed with #), and the explanation on line 157 should be formatted as a proper paragraph or list item rather than appearing as a standalone line after the code block.

Suggested change
Deny dangerous commands for cortexuser even with sudo
```
cortexuser ALL=(ALL) !/usr/bin/rm *, !/usr/sbin/shutdown, !/usr/sbin/reboot, !/usr/bin/passwd, !/usr/bin/cat /path/to/your/secure/files/*
```
The ! negates the permission for the specified command.

Deny dangerous commands for cortexuser even with sudo

cortexuser ALL=(ALL) !/usr/bin/rm , !/usr/sbin/shutdown, !/usr/sbin/reboot, !/usr/bin/passwd, !/usr/bin/cat /path/to/your/secure/files/

- The `!` negates the permission for the specified command.

Copilot uses AI. Check for mistakes.

Important Note on Tool Installation
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The heading 'Important Note on Tool Installation' on line 159 is not formatted as a markdown heading. It should use markdown heading syntax (e.g., '### Important Note on Tool Installation') to maintain proper document structure and hierarchy.

Suggested change
Important Note on Tool Installation
### Important Note on Tool Installation

Copilot uses AI. Check for mistakes.
System package managers (apt, yum, dnf, etc.) require root privileges. Granting passwordless sudo access to commands like apt install * is discouraged as it effectively grants full root access.

Safer alternatives for tool installation:

Pre-install Tools: Manually install all required security tools using your own sudo access before running CortexAI.

User-Level Installs: Instruct CortexAI to install tools in the user's home directory if the tool supports it (e.g., pip install --user, Go tools).

Use Docker: Run CortexAI within the provided CortexOS Docker container. Inside the container, the agent can safely install tools using the container's package manager without affecting your host system or requiring your host sudo password. This is the most secure and flexible approach.

Create a `.env` file with your AI provider credentials:

```env
Expand Down Expand Up @@ -235,18 +284,18 @@ Plugins auto-load at startup. The AI agent automatically discovers and uses new
- [x] OWASP/CWE vulnerability classification

### **Phase 2: Cross-Platform Desktop GUI** (In Progress)
- [ ] Electron-based desktop app (Linux, Windows, macOS)
- [ ] Visual project manager and scope editor
- [ ] Integrated database viewer with charts
- [ ] Real-time agent monitoring dashboard
- [x] Electron-based desktop app (Linux, Windows, macOS)
- [x] Visual project manager and scope editor
- [x] Integrated database viewer
- [x] Real-time agent monitoring dashboard
- [ ] Export reports (PDF, Markdown, JSON, HTML)

### **Phase 3: API-First Architecture**
- [ ] Node.js API server (Express/Fastify)
- [ ] PostgreSQL database for multi-user support
- [x] PostgreSQL database for multi-user support
- [ ] RESTful API for all core functions
- [ ] AI provider abstraction (Azure, OpenAI, Anthropic, Ollama, Gemini)
- [ ] User authentication and API key management
- [x] User authentication and API key management

### **Phase 4: Enterprise Features** (Proprietary)
- [ ] Intercepting HTTP/HTTPS proxy (Burp Suite equivalent)
Expand All @@ -257,14 +306,14 @@ Plugins auto-load at startup. The AI agent automatically discovers and uses new
- [ ] Compliance dashboards (PCI DSS, HIPAA, SOC 2)

### **Phase 5: Autonomous Agent Evolution**
- [ ] Multi-step goal planning with ReAct prompting
- [x] Multi-step goal planning with ReAct prompting
- [ ] Attack path graph modeling (Neo4j integration)
- [ ] Ethical governor with mandatory approval checkpoints
- [ ] Autonomous exploitation with human-in-the-loop
- [ ] Self-correction and adaptive replanning
- [x] Autonomous exploitation with human-in-the-loop
- [x] Self-correction and adaptive replanning

### **Phase 6: Ecosystem & SaaS**
- [ ] CortexAI Marketplace for third-party plugins
- [x] CortexAI Marketplace for third-party plugins
- [ ] Managed SaaS platform (multi-tenant cloud)
- [ ] Bug bounty platform integrations (HackerOne, Bugcrowd)
- [ ] Certification program (CCRTO: CortexAI Certified Red Team Operator)
Expand Down
Loading