# Let the corvault service user manage its own unit (and its journal)
# without a password so the `corvaultSRV` wrapper works seamlessly.
#
# Tight argument shapes — no trailing `*` — so the corvault user CANNOT
# pivot through `journalctl _SYSTEMD_UNIT=sshd.service`, `--root=/`,
# `-D /other/journal`, etc., to read logs from unrelated units. Each line
# below matches a single concrete call site in the corvaultSRV wrapper;
# update both files together when adding a new invocation.

Cmnd_Alias CORVAULT_CTL = \
    /usr/bin/systemctl start  corvault-company-server, \
    /usr/bin/systemctl stop   corvault-company-server, \
    /usr/bin/systemctl restart corvault-company-server, \
    /usr/bin/systemctl reload corvault-company-server, \
    /usr/bin/systemctl enable corvault-company-server, \
    /usr/bin/systemctl disable corvault-company-server

# Wrapper-specific journalctl shapes. The `--since=*` form expands a
# single token: it matches `--since=2026-05-29 12:00:00` but NOT extra
# trailing args (sudoers wildcards never cross whitespace), so an
# attacker cannot append `_SYSTEMD_UNIT=sshd` to leak other units' logs.
Cmnd_Alias CORVAULT_LOG = \
    /usr/bin/journalctl -u corvault-company-server --since=* --no-pager -o cat, \
    /usr/bin/journalctl -u corvault-company-server --no-pager -o cat, \
    /usr/bin/journalctl -u corvault-company-server -f

corvault ALL=(root) NOPASSWD: CORVAULT_CTL, CORVAULT_LOG
