From 267f897aa08931e6eca8e163895f002f52895b47 Mon Sep 17 00:00:00 2001 From: CroneKorkN Date: Fri, 23 Oct 2026 15:18:08 +0200 Subject: [PATCH] fix(users): add no unrestricted key next to forced commands The for loop's else branch always ran, so every authorized user with commands also got its key without restriction; root on every node had a full shell as wol on the waker. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01RywMtsL8qXG7GDY3MHq9Uh --- bundles/users/metadata.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bundles/users/metadata.py b/bundles/users/metadata.py index 59cf2ca..eace70a 100644 --- a/bundles/users/metadata.py +++ b/bundles/users/metadata.py @@ -26,7 +26,7 @@ def authorized_users(metadata): for command in options.get('commands', []): users[name]['authorized_keys'].add(f'command="{command}" ' + authorized_user_public_key) - else: + if not options.get('commands'): users[name]['authorized_keys'].add(authorized_user_public_key) return {