xudo

xudo is a Linux privilege broker. It checks commands against root-owned rules and uses the host's sudo, sudo-rs, or doas for privileged execution. This beta uses the human password path for every request.

This README is a derived view of howiwork.md, the source of truth for product behavior.

Install

No release has been published yet. When one is available, download the .deb, SHA256SUMS, and its .cosign.bundle from the GitHub Release, then verify both the checksum and the exact GitHub Actions identity before installing. Replace <ver> with the Debian version, <arch> with amd64 or arm64, and <tag> with the Git tag; for example, <ver> 0.1.0~beta.1 corresponds to <tag> v0.1.0-beta.1:

sha256sum -c SHA256SUMS --ignore-missing
cosign verify-blob --bundle xudo_<ver>_<arch>.deb.cosign.bundle --certificate-identity https://github.com/YaminT/xudo/.github/workflows/release.yml@refs/tags/<tag> --certificate-oidc-issuer https://token.actions.githubusercontent.com xudo_<ver>_<arch>.deb
sudo apt install ./xudo_<ver>_<arch>.deb

Each release also carries a CycloneDX SBOM, xudo-<version>.cdx.json (<version> is Cargo's spelling, for example 0.1.0-beta.1), listing every crate the shipped binaries link, as resolved for the two musl targets, with its Cargo.lock version and checksum. It is signed like the package; verify it with the same identity:

cosign verify-blob --bundle xudo-<version>.cdx.json.cosign.bundle --certificate-identity https://github.com/YaminT/xudo/.github/workflows/release.yml@refs/tags/<tag> --certificate-oidc-issuer https://token.actions.githubusercontent.com xudo-<version>.cdx.json

The four binaries also embed that dependency list (cargo-auditable). Read it from an installed binary with cargo audit bin /usr/bin/xudo. That embedded list may name a crate the binary does not link (errno); the SBOM does not. Building the package (just deb) needs cargo-auditable 0.7.7.

xudo has no curl | sh installer because a privileged shell script is difficult to inspect before execution.

The broker requires systemd and journald. Without them every privileged request is refused; systemd is recommended by the package and may be omitted by explicitly installing without recommendations.

Example

From a checkout, inspect the example rules with --rules ./rules:

xudo --rules ./rules explain -- /usr/bin/systemctl --no-pager --no-ask-password restart nginx.service
xudo doctor
ido queue -m "restart nginx after review" -- /usr/bin/systemctl restart nginx.service

explain shows the policy decision and executes nothing. exec ignores --rules. The installed broker loads root's /etc/xudo/rules.d. After installing the package, add your user to the xudo group (sudo usermod -aG xudo YOUR_USER, then log out and back in). This is a deliberate privilege grant: the group can invoke the installed password-authenticated gate.

Then run xudo exec -- /usr/bin/systemctl --no-pager --no-ask-password restart nginx.service. exec asks the broker. If a rule permits the command, the host's privilege backend prompts for a password and the gate runs it. ido queue stores exact arguments for a human to review and run with ido.

Security status

Beta. Not externally audited. The rule-file format and command-line interface may change, and an upgrade may require rule edits. Do not deploy this where a compromise would matter.

Agent detection is not a security boundary. The passwordless agent path is not in this release, so a successful impersonation cannot skip the password today. The allowlist is the boundary; the compiled-in deny-list is defense in depth because the set of programs that can become a root shell is not enumerable. xudo doctor reports some other paths to root, but cannot prove that a host has none.

M1 (policy core, explain) done. M2a (backend model) done. M2b done in code and tests (2026-10-30): the broker mints entries, the gate consumes one and runs it as root, xudo exec and xudo install ask the broker, both write one hash-chained audit trail, and the same ruleset behaves the same through sudo, sudo-rs and OpenDoas. M3 is built: out-of-band confirmation via xudo watch is off by default, and every path still requires the password. The broker runs under its real systemd sandbox, and Pasban verifies the audit chain daily. The doas install probe remains NOT VERIFIED. Next: M4 enrollment and the passwordless path, M5 temporary permissions, narrowing and volume controls (pasban's revocation substrate), M6 ergonomics (airead surfaces here), M7 confinement and external audit. confirm_human_path=false by default. just telemetry runs the strace no-telemetry check, also run by the CI job “no telemetry”. The passwordless agent path and Landlock confinement are not in this release.

The install probe runs /usr/bin/gnuid -u when /usr/bin/id is not a regular file, so stock Ubuntu 26.04 verifies. It reports installed, but NOT VERIFIED on doas and on a multicall-coreutils system with no regular probe program, such as Alpine.

The audit trail records authorization, not execution outcomes. Pasban runs daily as root. It verifies the audit chain and compares journal copies with the file by hash. It detects removed tails, cut-and-continued files, and forged chains the journal never saw. It does not prevent privileged tampering or prove that a command completed.

This is the beginning of the README. Read the rest at the original. Read the full README ↗