# Allow the pkgpoke service to run apt-get via the wrapper script in
# /usr/lib/pkgpoke/pkgpoke-apt. The wrapper itself only accepts the two
# exact subcommands "update" and "install <pkg>=<version>", so even though
# the rule below uses a wildcard to allow the install argument through,
# the surface area exposed to root is strictly bounded.
#
# Installed by the pkgpoke debian package as /etc/sudoers.d/pkgpoke,
# mode 0440 root:root. Verified via `visudo -c` in postinst.
pkgpoke ALL=(root) NOPASSWD: /usr/lib/pkgpoke/pkgpoke-apt update
pkgpoke ALL=(root) NOPASSWD: /usr/lib/pkgpoke/pkgpoke-apt install *
