# Installed as /etc/sudoers.d/hostit (mode 0440).
#
# App users need to enter their own container, which only root's podman can do.
# The grant is limited to one root-owned helper: it ignores its arguments when
# choosing a target and always enters the container belonging to SUDO_UID, so a
# member of hostit-apps can only ever reach their own app. (The helper runs
# without a tty; modern sudo does not require one, so no tty override is needed.)
%hostit-apps ALL=(root) NOPASSWD: /usr/lib/hostit/bin/hostit-enter
