From cf4c7b60a690fa8858ec3ff3521989a482bd4116 Mon Sep 17 00:00:00 2001
From: DuskyElf <duskyelf@users.noreply.github.com>
Date: Sun, 2 Aug 2026 09:18:49 +0530
Subject: [PATCH] fix(security): disable sudo timestamp cache

---
 system.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/system.nix b/system.nix
index c4900e4..ddebc95 100644
--- a/system.nix
+++ b/system.nix
@@ -113,6 +113,12 @@ in
       ln -sfn ${powerScript} /usr/local/sbin/power.sh
     '';
 
+    # Disable the credential cache: a fresh sudo timestamp (e.g. from a
+    # rebuild) would otherwise let anything running as duskyelf
+    # `sudo -n <anything>` within the window. NOPASSWD keybind rule is
+    # unaffected, but every other sudo now prompts fresh.
+    security.sudo.extraConfig = "Defaults timestamp_timeout=0";
+
     security.sudo.extraRules = [
       {
         users = [ "duskyelf" ];
-- 
2.51.2