# /etc/sudoers.d/soc-healthcheck
#
# Deployed to EVERY MONITORED HOST. Install with:
#     install -o root -g root -m 0440 sudoers-socmon /etc/sudoers.d/soc-healthcheck
#     visudo -cf /etc/sudoers.d/soc-healthcheck
#
# This is the entire privileged surface of the monitoring system, and it is
# deliberately two exact paths and nothing else.
#
# WHY IT IS SAFE, and the reasoning is the part worth keeping:
#
#   * The grant names two absolute paths with NO arguments wildcarded beyond
#     what each script validates itself. There is no `bash -s`, no shell, no
#     wrapper — a grant for any of those is equivalent to full root.
#
#   * Both scripts are owned by root and NOT writable by socmon. That is the
#     property that makes the whole thing hold: if the monitoring account could
#     rewrite the file it executes as root, the scoping would be decorative.
#     This is also why the orchestrator does NOT push these scripts on its
#     normal cron path — deployment is a separate, human-run action under a
#     different identity.
#
#   * The collector is strictly read-only. The installer is the only component
#     that writes, it refuses to run where Wazuh already exists, and it holds
#     its own lock.
#
#   * NOEXEC stops either script being used to spawn an interactive shell
#     through a library call.
#
# Verify after any change to either script:
#     sudo -l -U socmon

Defaults:socmon    !requiretty
Defaults:socmon    env_reset
Defaults:socmon    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Defaults:socmon    passwd_tries=1
Defaults:socmon    log_output
Defaults:socmon    logfile="/var/log/sudo-socmon.log"

# Read-only collector. Takes exactly one argument: light or deep.
socmon ALL=(root) NOEXEC, NOPASSWD: /usr/local/sbin/soc-healthcheck-node light, \
                                    /usr/local/sbin/soc-healthcheck-node deep

# Wazuh agent installer. Arguments are manager address, group and optional
# version; the script validates them and refuses if any Wazuh is present.
socmon ALL=(root) NOEXEC, NOPASSWD: /usr/local/sbin/soc-healthcheck-install-agent *
