# The unprivileged API may invoke only the fixed, validating transaction helper.
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction activate txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction confirm txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction rollback txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction status txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction activate ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction confirm ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction rollback ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction status ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-dns-transaction activate dns_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-dns-transaction rollback dns_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-dns-transaction status dns_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-hostname-transaction apply host_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-hostname-transaction rollback host_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-hostname-transaction status host_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-validate validate iptval_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-nft-validate validate txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction health txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-acme request
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-acme vendor-request
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-acme register-dns
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-acme status
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-policy-refresh
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-ids install
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-ids rules-update
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-ids status
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-ids uninstall
# 3.13.57: the IDS helper runs as a transient unit so apt escapes the API's
# ProtectSystem=strict sandbox (a read-only filesystem for the whole tree).
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-ids install
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-ids rules-update
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-ids status
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-ids uninstall
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-pools-sync sync
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-pools-sync portal-accept portal_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-admin-port set [0-9]*
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-admin-port show
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemctl start firewall-geoip.service
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-wireguard apply wg_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-wireguard rollback wg_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-wireguard status
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-wireguard down
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemctl start firewall-threats.service
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-update apply update_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-update apply update_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-resolv
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags show
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_LIVE_APPLY [01]
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_NETWORK_APPLY [01]
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_DNS_APPLY [01]
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_POLICY_REFRESH [01]
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_LIVE_APPLY [01] defer
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_NETWORK_APPLY [01] defer
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_DNS_APPLY [01] defer
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags set FIREWALL_ENABLE_POLICY_REFRESH [01] defer
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-flags restart
firewall-api ALL=(root) NOPASSWD: /usr/bin/systemd-run --quiet --wait --pipe /usr/local/sbin/firewall-integrity check
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-maintenance reboot
