# Security

This project intentionally keeps almost all functionality unprivileged.

## Privileged operation

Only `chvt` requires root privileges. The recommended sudoers rule is limited to:

```text
/usr/bin/chvt
```

or, when the machine uses fixed VTs, to explicit arguments such as:

```text
/usr/bin/chvt 1
/usr/bin/chvt 2
```

Do not configure unrestricted passwordless sudo for the user or for the recovery scripts.

## Non-interactive sudo

The recovery script always invokes sudo with `-n`:

```bash
sudo -n /usr/bin/chvt ...
```

This prevents the systemd user service from hanging on a password prompt.

## Boot safety

DRM hotplug events can occur during boot. The watcher and helper verify the current UID, an active Wayland session on seat0, and a valid VT. The helper rechecks the session after waiting and immediately before switching. IPC must identify an available configured Hyprland output. This check is not atomic with the VT switch; use one local Hyprland session per user.

## Reporting security issues

If this repository is published publicly, report security-sensitive findings privately through the repository owner's preferred security contact rather than opening a public issue containing exploitable details.

## Runtime and configuration

Runtime state requires a private, user-owned mode-0700 XDG_RUNTIME_DIR; there is
no shared /tmp fallback. Configuration is trusted Bash executed as the user.
Never run the installer or recovery scripts as root or allow untrusted users to
edit the scripts/config. Only chvt belongs in sudoers.

## Best-effort recovery

The helper checks both VT permissions and attempts to return on catchable signals
or failures. SIGKILL, power loss and persistent kernel/sudo failures can still
leave another VT active. The temporary VT can briefly expose another console.