PlumJam/nixos - Change QX3FF2DW36MOKM4IPNOIXCHSTL3KWA3VBI4EMN3VQDZNEYTB4YYAC

sudo: Use run0-sudo-shim.

Created by PlumJam on February 14, 2026

QX3FF2DW36MOKM4IPNOIXCHSTL3KWA3VBI4EMN3VQDZNEYTB4YYAC

Dependencies

In channels

main

Change contents

Replacement in modules/sudo.nix at line 2 [4.39047]
B:BD[3.152] → [3.152:179]
```
  sudoExtraConfig = # sudo
```
[3.152]
[3.179]
```
  sudoExtraConfig = # sudoers
```

Replacement in modules/sudo.nix at line 9 [4.39047]

B:BD[3.292] → [3.292:312]

∅:D[3.312] → [5.166:240]

∅:D[6.1175] → [5.166:240]

B:BD[5.166] → [5.166:240]

  sudoBaseLinux = {
    security.sudo-rs = {
      enable = true;
      execWheelOnly = true;

[3.292]

[3.313]

  sudoBaseLinux =
    {
      inputs,
      pkgs,
      lib,
      ...
    }:
    let
      inherit (lib.lists) singleton;
    in
    {
      users.users.jam.extraGroups = [ "wheel" ];
      security = {
        sudo.enable = false;
        polkit.enable = true;
        pam.services.systemd-run0 = {
          setLoginUid = true;
          pamMount = false;
        };
      };
      environment.systemPackages =
        singleton
          inputs.run0-sudo-shim.packages.${pkgs.stdenv.hostPlatform.system}.run0-sudo-shim;

Deletion in modules/sudo.nix at line 36 [4.39047]
B:BD[3.320] → [3.320:325]
```
  };
```

Replacement in modules/sudo.nix at line 47 [4.39047]

B:BD[3.521] → [3.521:546]

∅:D[3.546] → [5.240:274]

B:BD[5.240] → [5.240:274]

B:BD[5.274] → [3.547:584]

∅:D[3.584] → [5.433:440]

B:BD[5.433] → [5.433:440]

    security.sudo-rs = {
      wheelNeedsPassword = false;
      extraConfig = sudoExtraConfig;
    };

[3.521]

[5.440]

    # Persistent auth with run0.
    services.dbus.implementation = "broker";
    security.polkit.extraConfig = # js
      ''
        polkit.addRule(function(action, subject) {
          if (action.id == "org.freedesktop.policykit.exec") {
            return polkit.Result.AUTH_ADMIN_KEEP;
          }
        });
        polkit.addRule(function(action, subject) {
          if (action.id.indexOf("org.freedesktop.systemd1.") == 0) {
            return polkit.Result.AUTH_ADMIN_KEEP;
          }
        });
      '';

Replacement in modules/sudo.nix at line 68 [4.39047]
∅:D[3.641] → [5.599:626]
B:BD[5.599] → [5.599:626]
```
      extraConfig = # sudo
```
[3.641]
[5.626]
```
      extraConfig = # sudoers
```

Insertion in modules/sudo.nix at line 78 [4.39047]

[3.677]

  flake-file.inputs = {
    run0-sudo-shim = {
      url = "github:lordgrimmauld/run0-sudo-shim";
      inputs.nixpkgs.follows = "os";
    };
  };

Insertion in flake.nix at line 112 [8.24075]

[7.7335]

    };
    run0-sudo-shim = {
      inputs.nixpkgs.follows = "os";
      url = "github:lordgrimmauld/run0-sudo-shim";

Insertion in flake.lock at line 343 [8.25342]

[2.1746]

[2.1859]

    "flake-utils_4": {
      "inputs": {
        "systems": "systems_7"
      },
      "locked": {
        "lastModified": 1731533236,
        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },

Insertion in flake.lock at line 655 [8.25342]

[9.5777]

[7.8433]

        "type": "github"
      }
    },
    "nix-github-actions": {
      "inputs": {
        "nixpkgs": [
          "run0-sudo-shim",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1737420293,
        "narHash": "sha256-F1G5ifvqTpJq7fdkT34e/Jy9VCyzd5XfJ9TO8fHhJWE=",
        "owner": "nix-community",
        "repo": "nix-github-actions",
        "rev": "f4158fa080ef4503c8f4c820967d946c2af31ec9",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nix-github-actions",

Replacement in flake.lock at line 1011 [8.25342]

B:BD[10.124450] → [9.8376:8397]

        "rio": "rio"

[10.124450]

[8.28050]

        "rio": "rio",
        "run0-sudo-shim": "run0-sudo-shim"
      }
    },
    "run0-sudo-shim": {
      "inputs": {
        "flake-utils": "flake-utils_4",
        "nix-github-actions": "nix-github-actions",
        "nixpkgs": [
          "os"
        ],
        "rust-overlay": "rust-overlay_7",
        "treefmt-nix": "treefmt-nix_4"
      },
      "locked": {
        "lastModified": 1769894065,
        "narHash": "sha256-u8hioiUsIxUsjHhgA59ADaYWKNf5PcFAlY6/T0G1JtE=",
        "owner": "lordgrimmauld",
        "repo": "run0-sudo-shim",
        "rev": "8b2946a8c150766648ec89d5df780822b888775e",
        "type": "github"
      },
      "original": {
        "owner": "lordgrimmauld",
        "repo": "run0-sudo-shim",
        "type": "github"

Insertion in flake.lock at line 1183 [8.25342]

[7.9925]

[11.3763]

    "rust-overlay_7": {
      "inputs": {
        "nixpkgs": [
          "run0-sudo-shim",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1766371695,
        "narHash": "sha256-W7CX9vy7H2Jj3E8NI4djHyF8iHSxKpb2c/7uNQ/vGFU=",
        "owner": "oxalica",
        "repo": "rust-overlay",
        "rev": "d81285ba8199b00dc31847258cae3c655b605e8c",
        "type": "github"
      },
      "original": {
        "owner": "oxalica",
        "repo": "rust-overlay",
        "type": "github"
      }
    },

Insertion in flake.lock at line 1317 [8.25342]

[12.3086]

[9.12263]

    "systems_7": {
      "locked": {
        "lastModified": 1681028828,
        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
        "owner": "nix-systems",
        "repo": "default",
        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
        "repo": "default",
        "type": "github"
      }
    },

Insertion in flake.lock at line 1384 [8.25342]

[13.2799]

[14.3420]

        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "treefmt-nix",
        "type": "github"
      }
    },
    "treefmt-nix_4": {
      "inputs": {
        "nixpkgs": [
          "run0-sudo-shim",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1766000401,
        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
        "owner": "numtide",
        "repo": "treefmt-nix",
        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",