Approve as root
Getting what’s to be approved…
- Asked by
- What
- On
- Until
- With
The script, as it runs as root
Your passkey signs this script, these values and these Pis, as this page shows them: nothing else runs with it. Each Pi checks the signature is an admin’s passkey’s, from this page.
A passkey made here keeps the key Pis seal root’s password to. Only this page can use it, and Readout’s server never sees the key itself, so whoever has the server can’t read a Pi’s password.
Yours
Another
It needs a password manager that lets a passkey keep a secret (WebAuthn’s PRF): iCloud Keychain, Google Password Manager, a recent 1Password, or a security key.
Once the root policy is in force, the Pis seal it only to the keys the policy names. Add this line to release/root-policy.in (node scripts/root-key.mjs approvers on the server prints it too), and sign it:
- Pi
- Set
Sign in as root at the TV with a keyboard (Ctrl+Alt+F2), or over SSH as the home agent’s user, then su -.