# Jabali Panel — sudo bridge for SSH shell sandbox (nspawn mode).
#
# Installed at /etc/sudoers.d/jabali-nspawn by install.sh. Locked to the
# absolute path of jabali-nspawn-enter with no caller-controlled flags
# beyond a single image-name argument that the helper itself validates.
#
# Membership in jabali-ssh-sandbox is reconciled in lockstep with the
# package.ssh_enabled flag — only SSH-shell users get this privilege.

%jabali-ssh-sandbox ALL=(root) NOPASSWD: /usr/local/bin/jabali-nspawn-enter
Defaults!/usr/local/bin/jabali-nspawn-enter !env_reset, env_keep += "SUDO_USER"
