Nexus/docs/audit/2026-06-11-rsync-push-sudo-elevation.md

审计 — rsync 推送 sudo 提权 + 批量 sudoers 补丁

范围（文件清单）

文件	变更
server/utils/rsync_elevation.py	非 root 默认 sudo rsync
server/application/services/sync_engine_v2.py	_rsync_push 接入
server/application/services/files_sudoers_service.py	sudoers 模板与安装
server/api/sync_v2.py	诊断写入 sudo 回退
server/api/servers.py	setup-files-sudo 复用 service
scripts/batch_patch_files_sudoers.py	批量补丁脚本

Step 3 规则扫描

H	规则	结论
H1	sudoers 无用户注入	PASS — build_nexus_files_sudoers 固定白名单
H2	rsync-path 无外部输入	PASS — 常量 sudo -n rsync
H3	密码不经 argv	PASS — stdin sudo -S

Closure

H	判定	依据
H1	PASS	files_sudoers_service
H2	PASS	rsync_elevation.py
H3	PASS	_write_sudoers_with_password

DoD

• pytest test_rsync_elevation + test_nexus_files_sudoers
• changelog 2026-06-11-rsync-push-sudo-elevation.md
• 批量脚本 batch_patch_files_sudoers.sh

验证

pytest tests/test_rsync_elevation.py tests/test_nexus_files_sudoers.py -q
bash scripts/batch_patch_files_sudoers.sh --name 温胜夜 --dry-run