project %q: target user %q can run passwordless sudo. The ru

Error message

project %q: target user %q can run passwordless sudo. The run_as_user sandbox provides no isolation if the spawned agent can escalate non-interactively. Remove NOPASSWD sudo access for this user before starting cc-connect.

What it means

A fatal preflight error raised when the configured run_as_user has passwordless (NOPASSWD) sudo rights. If the sandboxed agent can escalate to root non-interactively, the run_as_user sandbox provides no real isolation, so cc-connect refuses to start. The message embeds the project name, target user, and the full `sudo -n -l` output when available.

Source

Thrown at core/runas_check.go:114

		result.Fatal = append(result.Fatal, fmt.Errorf(
			"project %q: passwordless sudo to user %q is not configured. Add a sudoers rule such as:\n  %s ALL=(%s) NOPASSWD: ALL\nthen restart cc-connect. Underlying error: %w",
			cfg.Project, cfg.RunAsUser, currentUsernameOr("<supervisor>"), cfg.RunAsUser, err))
		return result // subsequent checks are pointless
	}

	if _, err := cfg.Runner.Run(ctx, "-n", "-iu", cfg.RunAsUser, "--", "sudo", "-n", "/usr/bin/true"); err == nil {
		// Escalation succeeded — collect sudo -l from the target's
		// context to help the operator find the offending rule.
		if out, listErr := cfg.Runner.Run(ctx, "-n", "-iu", cfg.RunAsUser, "--", "sudo", "-n", "-l"); listErr == nil {
			result.SudoListOutput = strings.TrimSpace(string(out))
		}
		msg := fmt.Sprintf(
			"project %q: target user %q can run passwordless sudo. The run_as_user sandbox provides no isolation if the spawned agent can escalate non-interactively. Remove NOPASSWD sudo access for this user before starting cc-connect.",
			cfg.Project, cfg.RunAsUser)
		if result.SudoListOutput != "" {
			msg += "\n\n`sudo -n -l` as " + cfg.RunAsUser + ":\n" + indent(result.SudoListOutput, "  ")
		}
		result.Fatal = append(result.Fatal, errors.New(msg))
		// Don't return — still run check 3 so the operator gets all
		// the bad news in a single startup attempt.
	}

	if cfg.WorkDir == "" {
		result.Warnings = append(result.Warnings, fmt.Sprintf(
			"project %q: no work_dir configured; skipping filesystem access checks", cfg.Project))
	} else {
		absWorkDir := cfg.WorkDir
		if abs, err := filepath.Abs(absWorkDir); err == nil {
			absWorkDir = abs
		}
		if _, err := cfg.Runner.Run(ctx, "-n", "-iu", cfg.RunAsUser, "--", "test", "-r", absWorkDir, "-a", "-w", absWorkDir); err != nil {
			result.Fatal = append(result.Fatal, fmt.Errorf(
				"project %q: target user %q cannot read AND write work_dir %q. Agents will fail with EACCES at runtime. Fix ownership/permissions on this directory (chown/chmod or an ACL granting the target user rwx) before starting cc-connect.",
				cfg.Project, cfg.RunAsUser, absWorkDir))
		} else {
			warn := scanDescendants(ctx, cfg.Runner, cfg.RunAsUser, absWorkDir, cfg.ScanConfig)

View on GitHub (pinned to 4000b2338a)

Solutions

Remove NOPASSWD entries for the run_as_user from /etc/sudoers (use visudo) so `sudo -n -l` fails for that user.
Restrict the user's sudoers rules to specific non-escalating commands, or remove the user from the sudo/wheel group.
Re-run `cc-connect doctor user-isolation` / restart to confirm preflight passes.

Example fix

// before (/etc/sudoers)
agent ALL=(ALL) NOPASSWD: ALL
// after (/etc/sudoers via visudo — no entry for the sandbox user, or restricted)
# agent user must not have NOPASSWD sudo
agent ALL=(root) NOPASSWD: /usr/bin/systemctl restart myapp-only

Defensive patterns

Strategy: validation

Validate before calling

out, err := exec.Command("sudo", "-n", "-l", "-U", runAsUser).Output()
if err == nil {
    return fmt.Errorf("user %s still has passwordless sudo", runAsUser)
}

Try / catch

result := core.PreflightRunAsUser(ctx, cfg)
if len(result.Fatal) > 0 {
    log.Fatalf("isolation misconfigured, refusing to start: %v", result.Fatal)
}

Prevention

Audit sudoers regularly: `sudo -n -l -U <user>` must fail for the sandbox user.
Provision sandbox users via automation that never grants NOPASSWD.
Run `cc-connect doctor user-isolation` as a deployment gate.

When it happens

Trigger: During PreflightRunAsUser (core/runas_check.go:114), check 2 runs `sudo -n -l` as the target user and it succeeds, proving NOPASSWD escalation is possible for cfg.RunAsUser in project cfg.Project.

Common situations: Operator added the service user to sudoers with NOPASSWD:ALL for convenience; a cloud VM image grants the default user passwordless sudo; the sandbox user was reused from an admin role.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/3d95490ea573110a. Report an issue: GitHub.