From 732e5aca1135aa28b03b15d5bd032d63e3da4697 Mon Sep 17 00:00:00 2001
From: "othman.suseno" <othman.suseno@adastra.id>
Date: Mon, 15 Dec 2025 02:01:09 +0700
Subject: [PATCH] fix user permission issue

---
 install.sh              | 20 +++++++++++++++++++-
 internal/zfs/service.go | 22 +++++++++++++++++++++-
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/install.sh b/install.sh
index 3093362..7d3b15d 100755
--- a/install.sh
+++ b/install.sh
@@ -176,6 +176,22 @@ create_user() {
     else
         echo -e "${YELLOW}User $SERVICE_USER already exists${NC}"
     fi
+    
+    # Add user to disk group for block device access (required for ZFS)
+    if getent group disk > /dev/null 2>&1; then
+        usermod -a -G disk "$SERVICE_USER"
+        echo -e "${GREEN}Added $SERVICE_USER to disk group${NC}"
+    fi
+    
+    # Create sudoers configuration for ZFS commands
+    echo -e "${GREEN}Configuring sudo for ZFS operations...${NC}"
+    cat > /etc/sudoers.d/atlas-zfs <<EOF
+# Allow atlas user to run ZFS commands without password
+# This is required for ZFS pool operations
+$SERVICE_USER ALL=(ALL) NOPASSWD: /usr/sbin/zpool, /usr/bin/zpool, /sbin/zpool, /usr/sbin/zfs, /usr/bin/zfs, /sbin/zfs
+EOF
+    chmod 440 /etc/sudoers.d/atlas-zfs
+    echo -e "${GREEN}Sudo configuration created${NC}"
 }
 
 # Create directories
@@ -479,7 +495,9 @@ Environment="ATLAS_LOG_LEVEL=INFO"
 Environment="ATLAS_LOG_FORMAT=json"
 
 # Security
-NoNewPrivileges=true
+# Note: NoNewPrivileges is set to false to allow sudo for ZFS operations
+# This is necessary for ZFS pool management
+NoNewPrivileges=false
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=true
diff --git a/internal/zfs/service.go b/internal/zfs/service.go
index 22fb752..a40fa1e 100644
--- a/internal/zfs/service.go
+++ b/internal/zfs/service.go
@@ -27,8 +27,28 @@ func New() *Service {
 }
 
 // execCommand executes a shell command and returns output
+// For ZFS operations that require elevated privileges, it uses sudo
 func (s *Service) execCommand(name string, args ...string) (string, error) {
-	cmd := exec.Command(name, args...)
+	// Commands that require root privileges
+	privilegedCommands := []string{"zpool", "zfs"}
+	useSudo := false
+
+	for _, cmd := range privilegedCommands {
+		if strings.Contains(name, cmd) {
+			useSudo = true
+			break
+		}
+	}
+
+	var cmd *exec.Cmd
+	if useSudo {
+		// Use sudo for privileged commands
+		sudoArgs := append([]string{name}, args...)
+		cmd = exec.Command("sudo", sudoArgs...)
+	} else {
+		cmd = exec.Command(name, args...)
+	}
+
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr