# /etc/sudoers.d/netem-tc -- scoped NOPASSWD for modules/netem-link (step E).
# Operator-ruled 2026-07-21 ("Scoped NOPASSWD for tc (Recommended)"): the
# netem-link module runs `ssh vcloud 'sudo tc qdisc ...'` and the operator
# account has no passwordless sudo; this grants EXACTLY the two verbs the
# module issues, per measured mesh bridge, nothing else.
#
# INSTALL (operator, on vcloud -- visudo-checked, never edited in place):
#   sudo install -m 0440 -o root -g root scripts/sudoers.d/netem-tc /etc/sudoers.d/netem-tc
#   sudo visudo -c
#
# BRIDGE NAMES ARE MEASURED, NOT STABLE IDENTITY (libvirt auto-assigns
# virbrN; modules/mesh-link does not pin bridge names). Measured 2026-07-21
# on vcloud (virsh net-dumpxml):
#   virbr5 = mesh-vr1-dc0-vr1-dc1   (the step-E netem target)
#   virbr7 = mesh-vr1-dc0-office1
#   virbr3 = mesh-vr1-dc1-office1
# RE-MEASURE before every netem apply (the step-E runbook step does); if a
# mesh network is ever recreated, virbrN can change and this file MUST be
# re-issued from a fresh measurement -- a stale name here fails CLOSED
# (sudo denies), it cannot misapply to the wrong bridge silently unless the
# kernel reuses the name for another libvirt net, which the pre-apply
# re-measure exists to catch.
#
# Roosevelt: netem is VR-only (real fiber has real latency); this file has
# no Roosevelt analog and retires with VR1 (OPS-tagged, no D-number --
# GA-R3 doubt resolves down).

jessea123 ALL=(root) NOPASSWD: /usr/sbin/tc qdisc replace dev virbr5 root netem *
jessea123 ALL=(root) NOPASSWD: /usr/sbin/tc qdisc del dev virbr5 root
jessea123 ALL=(root) NOPASSWD: /usr/sbin/tc qdisc replace dev virbr7 root netem *
jessea123 ALL=(root) NOPASSWD: /usr/sbin/tc qdisc del dev virbr7 root
jessea123 ALL=(root) NOPASSWD: /usr/sbin/tc qdisc replace dev virbr3 root netem *
jessea123 ALL=(root) NOPASSWD: /usr/sbin/tc qdisc del dev virbr3 root