ndev-stack 0.3.12__tar.gz → 0.3.13__tar.gz

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ndev-stack
-Version: 0.3.12
+Version: 0.3.13
 Summary: Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows
 Author-email: Ankit Karan <ankit.karan99@gmail.com>
 Project-URL: Homepage, https://github.com/ankitkaran99/ndev

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/ndev/__init__.py

@@ -1,7 +1,7 @@
 """
 ndev: Fast, cross-platform PHP developer environment for Windows and Linux.
 """
-__version__ = "0.3.12"
+__version__ = "0.3.13"
 
 from . import common as common
 from .common.logger import logger as logger

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/ndev/linux/commands/doctor.py

@@ -74,6 +74,22 @@ def doctor_cmd():
     else:
         table.add_row("mkcert Local SSL", "[yellow]NOT INSTALLED[/yellow]", "Optional for SSL. Run 'ndev upgrade mkcert' to install.")
 
+    try:
+        from ndev.linux.runtime.nginx_helper import is_selinux_enforcing, is_selinux_httpd_permissive
+        if is_selinux_enforcing():
+            if is_selinux_httpd_permissive():
+                table.add_row("SELinux Web Server Access", "[green]OK[/green]", "Enforcing mode, httpd_t is permissive")
+            else:
+                table.add_row(
+                    "SELinux Web Server Access",
+                    "[yellow]RESTRICTED[/yellow]",
+                    "Enforcing. Nginx cannot access ~/Sites or FastCGI sockets. Run: sudo /usr/sbin/semanage permissive -a httpd_t"
+                )
+        else:
+            table.add_row("SELinux Web Server Access", "[green]OK[/green]", "SELinux is permissive or disabled")
+    except Exception:
+        pass
+
     if NDEV_DIR.exists():
         table.add_row("Layout Directory (~/.ndev)", "[green]OK[/green]", f"Exists at {NDEV_DIR}")
     else:

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/ndev/linux/commands/setup.py

@@ -71,6 +71,12 @@ def setup_cmd():
             except Exception:
                 pass
 
+            try:
+                from ndev.linux.runtime.nginx_helper import ensure_selinux_httpd_permissions
+                ensure_selinux_httpd_permissions()
+            except Exception:
+                pass
+
             console.print("[bold green]MariaDB, Nginx, and Bubblewrap installed and configured successfully![/bold green]\n")
         else:
             # 1. Update Package Lists

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/ndev/linux/commands/vhost.py

@@ -321,6 +321,7 @@ def vhost_cmd(
         ensure_nginx_sites_enabled_included,
         install_nginx_ssl_cert,
         ensure_docroot_accessible,
+        ensure_selinux_httpd_permissions,
         add_to_hosts_privileged,
         reload_nginx,
     )
@@ -350,6 +351,7 @@ def vhost_cmd(
             logger.warning(f"Could not install SSL certificate to /etc/nginx/ssl: {e}")
 
     ensure_docroot_accessible(root_path)
+    ensure_selinux_httpd_permissions()
 
     conf_file = vhost_dir / f"{domain}.conf"
     config_template = generate_vhost_config(

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/ndev/linux/runtime/nginx_helper.py

@@ -66,6 +66,96 @@ def check_sudo_needs_password() -> bool:
         return True
 
 
+def run_privileged_command(
+    cmd: list[str],
+    password: Optional[str] = None,
+    check: bool = True,
+    timeout: int = 60,
+    capture_output: bool = True
+) -> subprocess.CompletedProcess:
+    """
+    Run a command with elevated privileges using sudo -n if non-root.
+    Validates sudo password first if provided to refresh the sudo credential timestamp.
+    """
+    full_cmd = list(cmd)
+    if os.geteuid() != 0:
+        if password:
+            validate_sudo_password(password)
+        full_cmd = ["sudo", "-n"] + full_cmd
+    return subprocess.run(
+        full_cmd,
+        check=check,
+        timeout=timeout,
+        capture_output=capture_output,
+        text=True
+    )
+
+
+def is_selinux_enforcing() -> bool:
+    """Check if SELinux is present and in Enforcing mode."""
+    enforce_file = Path("/sys/fs/selinux/enforce")
+    if enforce_file.exists():
+        try:
+            return enforce_file.read_text().strip() == "1"
+        except Exception:
+            pass
+    getenforce = shutil.which("getenforce") or "/usr/sbin/getenforce"
+    if Path(getenforce).exists():
+        try:
+            res = subprocess.run([getenforce], capture_output=True, text=True, timeout=2)
+            return res.stdout.strip().lower() == "enforcing"
+        except Exception:
+            pass
+    return False
+
+
+def is_selinux_httpd_permissive() -> bool:
+    """Check if httpd_t is in SELinux permissive types."""
+    if not is_selinux_enforcing():
+        return True
+    seinfo = shutil.which("seinfo") or "/usr/bin/seinfo"
+    if Path(seinfo).exists():
+        try:
+            res = subprocess.run([seinfo, "--permissive"], capture_output=True, text=True, timeout=3)
+            return "httpd_t" in res.stdout
+        except Exception:
+            pass
+    return False
+
+
+def ensure_selinux_httpd_permissions(password: Optional[str] = None) -> bool:
+    """
+    Ensure SELinux allows Nginx (httpd_t) to access user document roots and FastCGI sockets.
+    If SELinux is enforcing and httpd_t is not permissive, add httpd_t to permissive types
+    via semanage and enable relevant SELinux booleans.
+    """
+    if not is_selinux_enforcing() or is_selinux_httpd_permissive():
+        return True
+
+    success = False
+    semanage = shutil.which("semanage") or "/usr/sbin/semanage"
+    if Path(semanage).exists():
+        try:
+            run_privileged_command([semanage, "permissive", "-a", "httpd_t"], password=password, check=False)
+            success = is_selinux_httpd_permissive()
+        except Exception as e:
+            logger.warning(f"Failed to set httpd_t permissive via semanage: {e}")
+
+    # Also enable booleans as supplementary fallback
+    setsebool = shutil.which("setsebool") or "/usr/sbin/setsebool"
+    if Path(setsebool).exists():
+        try:
+            run_privileged_command(
+                [setsebool, "-P", "httpd_read_user_content=1", "httpd_enable_homedirs=1", "httpd_can_network_connect=1"],
+                password=password,
+                check=False
+            )
+        except Exception:
+            pass
+
+    return success or is_selinux_httpd_permissive()
+
+
 def write_privileged_file(target: Path, content: str, password: Optional[str] = None) -> None:
     """
     Write content to a file, using sudo tee if current process lacks permissions.
@@ -527,10 +617,24 @@ def ensure_docroot_accessible(root_path: Path) -> None:
     try:
         resolved_root = root_path.resolve()
         resolved_home = home.resolve()
-        if resolved_root == resolved_home or resolved_root.is_relative_to(resolved_home):
-            st = home.stat()
-            if not (st.st_mode & 0o001):
-                os.chmod(str(home), st.st_mode | 0o001)
+
+        # Traverse every directory from root_path up to home and ensure +x (0o001)
+        curr = resolved_root
+        while curr != curr.parent:
+            try:
+                st = curr.stat()
+                if not (st.st_mode & 0o001):
+                    os.chmod(str(curr), st.st_mode | 0o001)
+            except Exception:
+                pass
+            if curr == resolved_home:
+                break
+            curr = curr.parent
+
+        # Also ensure home directory itself has +x
+        st = resolved_home.stat()
+        if not (st.st_mode & 0o001):
+            os.chmod(str(resolved_home), st.st_mode | 0o001)
     except Exception:
         pass
 

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/ndev/linux/tui.py

@@ -12,7 +12,7 @@ import subprocess
 import threading
 import webbrowser
 from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Callable, Dict, List, Optional, Tuple
 
 from rich.text import Text
 from textual import on, work
@@ -265,6 +265,12 @@ class SudoPasswordModal(ModalScreen[Optional[str]]):
                 yield Button("Authenticate", variant="primary", id="btn-auth-confirm")
                 yield Button("Cancel", variant="default", id="btn-auth-cancel")
 
+    def on_mount(self) -> None:
+        try:
+            self.query_one("#input-sudo-pass", Input).focus()
+        except Exception:
+            pass
+
     def on_input_submitted(self, event: Input.Submitted) -> None:
         self.query_one("#btn-auth-confirm", Button).press()
 
@@ -327,6 +333,12 @@ class CreateVhostModal(ModalScreen[Optional[dict]]):
                 yield Button("Create VHost", variant="success", id="btn-modal-create")
                 yield Button("Cancel", variant="default", id="btn-modal-cancel")
 
+    def on_mount(self) -> None:
+        try:
+            self.query_one("#input-vhost-domain", Input).focus()
+        except Exception:
+            pass
+
     def on_input_submitted(self, event: Input.Submitted) -> None:
         self.query_one("#btn-modal-create", Button).press()
 
@@ -516,6 +528,8 @@ class NdevDashboard(App):
 
     def _needs_sudo(self) -> bool:
         """Check if elevated privileges are needed and require a password prompt."""
+        if os.geteuid() == 0:
+            return False
         from ndev.linux.runtime.nginx_helper import check_sudo_needs_password, validate_sudo_password
         if not check_sudo_needs_password():
             return False
@@ -523,6 +537,27 @@ class NdevDashboard(App):
             return False
         return True
 
+    def ensure_sudo(self, action_name: str, callback: Callable[[Optional[str]], None]) -> None:
+        """
+        Ensure sudo access is ready before executing a privileged action.
+        If sudo requires password and we don't have a valid cached password,
+        present SudoPasswordModal. Once authenticated, cache password and invoke callback(password).
+        If cancelled, notify user and abort action.
+        If sudo does not require a password, invoke callback(self._sudo_password) immediately.
+        """
+        if not self._needs_sudo():
+            callback(self._sudo_password)
+            return
+
+        def _on_pwd(pwd: Optional[str]) -> None:
+            if pwd:
+                self._sudo_password = pwd
+                callback(pwd)
+            else:
+                self.notify("Administrator authentication cancelled.", severity="warning")
+
+        self.push_screen(SudoPasswordModal(action_name), _on_pwd)
+
     def compose(self) -> ComposeResult:
         yield Header(show_clock=True)
 
@@ -938,19 +973,29 @@ class NdevDashboard(App):
 
     # ── ACTION WORKERS ────────────────────────────────────────────────────────
 
-    @work(exclusive=True)
-    async def action_start_all(self) -> None:
+    def action_start_all(self) -> None:
         """Start all services and FastCGI pools."""
+        self.ensure_sudo("Starting all services", self._start_all_worker)
+
+    @work(exclusive=True)
+    async def _start_all_worker(self, password: Optional[str] = None) -> None:
         self.log_message("[bold blue]Starting all services...[/bold blue]")
         self.notify("Starting all web services...", severity="information")
 
         def _do() -> None:
+            from ndev.linux.runtime.nginx_helper import run_privileged_command
             # 1. Nginx
             if shutil.which("systemctl"):
-                subprocess.run(["sudo", "systemctl", "start", "nginx"])
+                try:
+                    run_privileged_command(["systemctl", "start", "nginx"], password=password, check=False)
+                except Exception as e:
+                    self.log_message(f"[yellow]Nginx start notice: {e}[/yellow]")
             # 2. MariaDB
             if shutil.which("systemctl"):
-                subprocess.run(["sudo", "systemctl", "start", "mariadb"])
+                try:
+                    run_privileged_command(["systemctl", "start", "mariadb"], password=password, check=False)
+                except Exception as e:
+                    self.log_message(f"[yellow]MariaDB start notice: {e}[/yellow]")
             # 3. phpMyAdmin
             try:
                 start_pma()
@@ -980,16 +1025,26 @@ class NdevDashboard(App):
         self.notify("All services started.", severity="information")
         self._refresh_all_data(full_rebuild=False)
 
-    @work(exclusive=True)
-    async def action_stop_all(self) -> None:
+    def action_stop_all(self) -> None:
         """Stop all running services and FastCGI pools."""
+        self.ensure_sudo("Stopping all services", self._stop_all_worker)
+
+    @work(exclusive=True)
+    async def _stop_all_worker(self, password: Optional[str] = None) -> None:
         self.log_message("[bold blue]Stopping all services...[/bold blue]")
         self.notify("Stopping all web services...", severity="information")
 
         def _do() -> None:
+            from ndev.linux.runtime.nginx_helper import run_privileged_command
             if shutil.which("systemctl"):
-                subprocess.run(["sudo", "systemctl", "stop", "nginx"])
-                subprocess.run(["sudo", "systemctl", "stop", "mariadb"])
+                try:
+                    run_privileged_command(["systemctl", "stop", "nginx"], password=password, check=False)
+                except Exception:
+                    pass
+                try:
+                    run_privileged_command(["systemctl", "stop", "mariadb"], password=password, check=False)
+                except Exception:
+                    pass
             stop_pma()
             try:
                 from ndev.common.modules import get_module_manager
@@ -1007,16 +1062,26 @@ class NdevDashboard(App):
         self.notify("All services stopped.", severity="information")
         self._refresh_all_data(full_rebuild=False)
 
-    @work(exclusive=True)
-    async def action_restart_all(self) -> None:
+    def action_restart_all(self) -> None:
         """Restart all services."""
+        self.ensure_sudo("Restarting all services", self._restart_all_worker)
+
+    @work(exclusive=True)
+    async def _restart_all_worker(self, password: Optional[str] = None) -> None:
         self.log_message("[bold blue]Restarting all services...[/bold blue]")
         self.notify("Restarting all web services...", severity="information")
 
         def _do() -> None:
+            from ndev.linux.runtime.nginx_helper import run_privileged_command
             if shutil.which("systemctl"):
-                subprocess.run(["sudo", "systemctl", "restart", "nginx"])
-                subprocess.run(["sudo", "systemctl", "restart", "mariadb"])
+                try:
+                    run_privileged_command(["systemctl", "restart", "nginx"], password=password, check=False)
+                except Exception:
+                    pass
+                try:
+                    run_privileged_command(["systemctl", "restart", "mariadb"], password=password, check=False)
+                except Exception:
+                    pass
             restart_pma()
             try:
                 from ndev.common.modules import get_module_manager
@@ -1034,29 +1099,25 @@ class NdevDashboard(App):
         self.notify("All services restarted.", severity="information")
         self._refresh_all_data(full_rebuild=False)
 
-    @work(exclusive=True)
-    async def action_reload_nginx(self) -> None:
+    def action_reload_nginx(self) -> None:
         """Reload Nginx configuration."""
+        self.ensure_sudo("Reloading Nginx", self._reload_nginx_worker)
+
+    @work(exclusive=True)
+    async def _reload_nginx_worker(self, password: Optional[str] = None) -> None:
         self.log_message("[bold blue]Reloading Nginx configuration...[/bold blue]")
 
-        def _do_reload(pwd: Optional[str] = None) -> None:
+        def _do_reload() -> bool:
             from ndev.linux.runtime.nginx_helper import reload_nginx
-            ok = reload_nginx(password=pwd or self._sudo_password)
-            if ok:
-                self.log_message("[bold green]✓ Nginx configuration reloaded successfully.[/bold green]")
-                self.notify("Nginx reloaded.", severity="information")
-            else:
-                self.log_message("[bold red]✗ Failed to reload Nginx.[/bold red]")
-                self.notify("Nginx reload failed.", severity="error")
+            return reload_nginx(password=password)
 
-        if self._needs_sudo():
-            def _on_pwd(pwd: Optional[str]) -> None:
-                if pwd:
-                    self._sudo_password = pwd
-                    asyncio.create_task(asyncio.to_thread(_do_reload, pwd))
-            self.push_screen(SudoPasswordModal("Reloading Nginx"), _on_pwd)
+        ok = await asyncio.to_thread(_do_reload)
+        if ok:
+            self.log_message("[bold green]✓ Nginx configuration reloaded successfully.[/bold green]")
+            self.notify("Nginx reloaded.", severity="information")
         else:
-            await asyncio.to_thread(_do_reload, self._sudo_password)
+            self.log_message("[bold red]✗ Failed to reload Nginx.[/bold red]")
+            self.notify("Nginx reload failed.", severity="error")
 
     @work(exclusive=True)
     async def action_check_upgrades(self) -> None:
@@ -1187,7 +1248,14 @@ class NdevDashboard(App):
                 pwd = res.get("password") or self._sudo_password
                 if pwd:
                     self._sudo_password = pwd
-                self._create_vhost_worker(res["domain"], res["root"], res["php"], res["ssl"], password=pwd)
+                domain = res["domain"]
+                root = res["root"]
+                php_ver = res["php"]
+                ssl = res["ssl"]
+                self.ensure_sudo(
+                    f"Creating virtual host '{domain}'",
+                    lambda valid_pwd: self._create_vhost_worker(domain, root, php_ver, ssl, password=valid_pwd)
+                )
 
         self.push_screen(CreateVhostModal(installed, curr, needs_sudo=self._needs_sudo()), _on_modal_result)
 
@@ -1205,6 +1273,7 @@ class NdevDashboard(App):
                 ensure_nginx_sites_enabled_included,
                 install_nginx_ssl_cert,
                 ensure_docroot_accessible,
+                ensure_selinux_httpd_permissions,
                 write_privileged_file,
                 symlink_privileged,
                 add_to_hosts_privileged,
@@ -1233,6 +1302,7 @@ class NdevDashboard(App):
                     logger.warning(f"Could not install SSL certificate into /etc/nginx/ssl: {e}")
 
             ensure_docroot_accessible(Path(root))
+            ensure_selinux_httpd_permissions(password=password)
 
             mm = php_ver.replace(".", "")[:2] if "." in php_ver else php_ver
             selected_sock = NDEV_DIR / "run" / f"php{mm}.sock"
@@ -1280,20 +1350,12 @@ class NdevDashboard(App):
         row_key = vhost_table.coordinate_to_cell_key((vhost_table.cursor_row, 0)).row_key
         domain = str(row_key.value)
 
-        def _do_delete(pwd: Optional[str] = None) -> None:
-            if pwd:
-                self._sudo_password = pwd
-            self._delete_vhost_worker(domain, password=pwd or self._sudo_password)
-
         def _on_confirm(confirmed: bool) -> None:
             if confirmed:
-                if self._needs_sudo():
-                    self.push_screen(
-                        SudoPasswordModal(f"Deleting virtual host '{domain}'"),
-                        lambda pwd: _do_delete(pwd) if pwd else None
-                    )
-                else:
-                    _do_delete(self._sudo_password)
+                self.ensure_sudo(
+                    f"Deleting virtual host '{domain}'",
+                    lambda pwd: self._delete_vhost_worker(domain, password=pwd)
+                )
 
         msg = f"Are you sure you want to delete virtual host '{domain}'?\n\nThis will remove its Nginx configuration, SSL certificates, and hosts entry."
         self.push_screen(ConfirmActionModal("Delete Virtual Host", msg, confirm_label="Delete VHost", variant="error"), _on_confirm)
@@ -1315,8 +1377,6 @@ class NdevDashboard(App):
         except Exception as e:
             self.log_message(f"[bold red]✗ Failed to delete virtual host {domain}: {e}[/bold red]")
             self.notify(f"Delete failed: {e}", severity="error")
-            self.log_message(f"[bold red]✗ Failed to delete virtual host {domain}: {e}[/bold red]")
-            self.notify(f"Delete failed: {e}", severity="error")
 
     def action_install_php(self) -> None:
         """Open modal dialog to install a new PHP runtime."""
@@ -1385,7 +1445,7 @@ class NdevDashboard(App):
             self.notify(f"Uninstall failed: {e}", severity="error")
 
     def _handle_selected_service_install(self) -> None:
-        """Install or setup the selected service (PMA, Mailpit, Nginx, MariaDB)."""
+        """Install or setup the selected service (PMA, Mailpit, Nginx, MariaDB, Redis)."""
         svc_table = self.query_one("#table-services", DataTable)
         if svc_table.cursor_row is not None and svc_table.row_count > 0:
             row_key = svc_table.coordinate_to_cell_key((svc_table.cursor_row, 0)).row_key
@@ -1396,34 +1456,41 @@ class NdevDashboard(App):
             self.notify("Please select a service row from the table.", severity="warning")
             return
 
-        self._install_service_worker(key)
+        if key in ["nginx", "mariadb", "redis"]:
+            self.ensure_sudo(
+                f"Install {key}",
+                lambda pwd: self._install_service_worker(key, password=pwd)
+            )
+        else:
+            self._install_service_worker(key)
 
     @work(exclusive=True)
-    async def _install_service_worker(self, key: str) -> None:
+    async def _install_service_worker(self, key: str, password: Optional[str] = None) -> None:
         self.query_one(TabbedContent).active = "tab-logs"
         self.log_message(f"[bold blue]Installing/setting up component '{key}'...[/bold blue]")
         self.notify(f"Installing {key}...", severity="information")
 
         def _do() -> None:
+            from ndev.linux.runtime.nginx_helper import run_privileged_command
             if key == "pma":
                 setup_pma()
             elif key == "mailpit":
                 setup_mailpit()
             elif key == "redis":
                 if shutil.which("zypper"):
-                    subprocess.run(["sudo", "zypper", "--non-interactive", "install", "-y", "redis"], check=True)
+                    run_privileged_command(["zypper", "--non-interactive", "install", "-y", "redis"], password=password, timeout=300)
                 elif shutil.which("apt") or shutil.which("apt-get"):
-                    subprocess.run(["sudo", "apt-get", "install", "-y", "redis-server"], check=True)
+                    run_privileged_command(["apt-get", "install", "-y", "redis-server"], password=password, timeout=300)
             elif key == "nginx":
                 if shutil.which("zypper"):
-                    subprocess.run(["sudo", "zypper", "--non-interactive", "install", "-y", "nginx"], check=True)
+                    run_privileged_command(["zypper", "--non-interactive", "install", "-y", "nginx"], password=password, timeout=300)
                 elif shutil.which("apt") or shutil.which("apt-get"):
-                    subprocess.run(["sudo", "apt-get", "install", "-y", "nginx"], check=True)
+                    run_privileged_command(["apt-get", "install", "-y", "nginx"], password=password, timeout=300)
             elif key == "mariadb":
                 if shutil.which("zypper"):
-                    subprocess.run(["sudo", "zypper", "--non-interactive", "install", "-y", "mariadb", "mariadb-client"], check=True)
+                    run_privileged_command(["zypper", "--non-interactive", "install", "-y", "mariadb", "mariadb-client"], password=password, timeout=300)
                 elif shutil.which("apt") or shutil.which("apt-get"):
-                    subprocess.run(["sudo", "apt-get", "install", "-y", "mariadb-server"], check=True)
+                    run_privileged_command(["apt-get", "install", "-y", "mariadb-server"], password=password, timeout=300)
 
             elif key.startswith("mod:"):
                 mod_name = key.split(":", 1)[1]
@@ -1522,8 +1589,7 @@ class NdevDashboard(App):
             if row_key:
                 self._switch_php_version(row_key)
 
-    @work(exclusive=True)
-    async def _handle_selected_service_action(self, action: str) -> None:
+    def _handle_selected_service_action(self, action: str) -> None:
         """Contextually start, stop, or restart the service highlighted in the table."""
         svc_table = self.query_one("#table-services", DataTable)
         if svc_table.cursor_row is not None and svc_table.row_count > 0:
@@ -1535,20 +1601,35 @@ class NdevDashboard(App):
             self.notify("Please select a service row from the table.", severity="warning")
             return
 
+        if key in ["nginx", "mariadb"]:
+            self.ensure_sudo(
+                f"{action.capitalize()} {key}",
+                lambda pwd: self._service_action_worker(key, action, password=pwd)
+            )
+        else:
+            self._service_action_worker(key, action)
+
+    @work(exclusive=True)
+    async def _service_action_worker(self, key: str, action: str, password: Optional[str] = None) -> None:
         self.log_message(f"[bold blue]Executing '{action}' on {key}...[/bold blue]")
 
         def _do() -> None:
+            from ndev.linux.runtime.nginx_helper import run_privileged_command
             if key == "nginx":
                 if shutil.which("systemctl"):
-                    subprocess.run(["sudo", "systemctl", action, "nginx"], check=True)
+                    run_privileged_command(["systemctl", action, "nginx"], password=password)
                 else:
-                    subprocess.run(["sudo", "service", "nginx", action], check=True)
+                    run_privileged_command(["service", "nginx", action], password=password)
 
             elif key == "mariadb":
+                svc_name = "mariadb"
                 if shutil.which("systemctl"):
-                    subprocess.run(["sudo", "systemctl", action, "mariadb"], check=True)
+                    chk = subprocess.run(["systemctl", "status", "mariadb"], capture_output=True)
+                    if chk.returncode == 4:
+                        svc_name = "mysql"
+                    run_privileged_command(["systemctl", action, svc_name], password=password)
                 else:
-                    subprocess.run(["sudo", "service", "mariadb", action], check=True)
+                    run_privileged_command(["service", svc_name, action], password=password)
 
             elif key == "pma":
                 if action == "start":

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/ndev_stack.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ndev-stack
-Version: 0.3.12
+Version: 0.3.13
 Summary: Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows
 Author-email: Ankit Karan <ankit.karan99@gmail.com>
 Project-URL: Homepage, https://github.com/ankitkaran99/ndev

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ndev-stack"
-version = "0.3.12"
+version = "0.3.13"
 description = "Cross-platform developer stack manager for PHP, FastCGI/PHP-FPM, MariaDB, Redis, PostgreSQL, MongoDB, Nginx, SSL, and Mailpit on Linux and Windows"
 readme = "README.md"
 requires-python = ">=3.10"

{ndev_stack-0.3.12 → ndev_stack-0.3.13}/tests/test_opensuse_compat.py

@@ -4,6 +4,7 @@ Includes tests for distro detection, caching, Nginx vhost management, service di
 log resolution, and process permission handling.
 """
 import os
+import subprocess
 import unittest
 from unittest.mock import patch, MagicMock
 from pathlib import Path
@@ -331,6 +332,52 @@ class TestNginxHelper(unittest.TestCase):
                 self.assertTrue(removed)
                 self.assertFalse(conf_file.exists())
 
+    def test_run_privileged_command(self):
+        with patch("subprocess.run") as mock_run:
+            mock_run.return_value = subprocess.CompletedProcess(args=["systemctl", "status"], returncode=0)
+            with patch("os.geteuid", return_value=1000):
+                with patch("ndev.linux.runtime.nginx_helper.validate_sudo_password") as mock_val:
+                    nginx_helper.run_privileged_command(["systemctl", "status", "nginx"], password="secret")
+                    mock_val.assert_called_once_with("secret")
+                    mock_run.assert_called_once()
+                    self.assertEqual(mock_run.call_args[0][0], ["sudo", "-n", "systemctl", "status", "nginx"])
+
+    def test_is_selinux_enforcing_and_permissive(self):
+        with patch.object(Path, "exists", return_value=True):
+            with patch.object(Path, "read_text", return_value="1\n"):
+                self.assertTrue(nginx_helper.is_selinux_enforcing())
+
+        with patch("ndev.linux.runtime.nginx_helper.is_selinux_enforcing", return_value=True):
+            with patch("shutil.which", return_value="/usr/bin/seinfo"):
+                with patch("subprocess.run") as mock_run:
+                    mock_run.return_value = subprocess.CompletedProcess(args=[], returncode=0, stdout="Permissive Types: 2\n   httpd_t\n   xrdp_t\n")
+                    self.assertTrue(nginx_helper.is_selinux_httpd_permissive())
+
+                    mock_run.return_value = subprocess.CompletedProcess(args=[], returncode=0, stdout="Permissive Types: 1\n   xrdp_t\n")
+                    self.assertFalse(nginx_helper.is_selinux_httpd_permissive())
+
+    def test_ensure_selinux_httpd_permissions(self):
+        with patch("ndev.linux.runtime.nginx_helper.is_selinux_enforcing", return_value=True):
+            with patch("ndev.linux.runtime.nginx_helper.is_selinux_httpd_permissive", side_effect=[False, True]):
+                with patch("ndev.linux.runtime.nginx_helper.run_privileged_command") as mock_priv:
+                    res = nginx_helper.ensure_selinux_httpd_permissions(password="pwd")
+                    self.assertTrue(res)
+                    mock_priv.assert_called()
+
+    def test_ensure_docroot_accessible_ancestors(self):
+        home_dir = self.test_dir / "userhome"
+        sub_dir = home_dir / "opt" / "Sites" / "app" / "public"
+        sub_dir.mkdir(parents=True)
+        # Remove other execute
+        os.chmod(home_dir, 0o700)
+        os.chmod(home_dir / "opt", 0o700)
+
+        with patch("pathlib.Path.home", return_value=home_dir):
+            with patch.dict(os.environ, {}, clear=True):
+                nginx_helper.ensure_docroot_accessible(sub_dir)
+                self.assertTrue(bool(home_dir.stat().st_mode & 0o001))
+                self.assertTrue(bool((home_dir / "opt").stat().st_mode & 0o001))
+
 
 class TestSocketsAndProcess(unittest.TestCase):
     def test_get_major_minor_safe(self):
@@ -502,5 +549,35 @@ class TestTuiSelectEventHandling(unittest.TestCase):
                 app._switch_php_version.assert_called_once_with("8.4.27")
 
 
+class TestTuiEnsureSudo(unittest.TestCase):
+    def test_ensure_sudo_when_not_needed(self):
+        from ndev.linux.tui import NdevDashboard
+        app = NdevDashboard()
+        app._needs_sudo = MagicMock(return_value=False)
+        app._sudo_password = "cached_password"
+
+        callback = MagicMock()
+        app.ensure_sudo("Test Action", callback)
+        callback.assert_called_once_with("cached_password")
+
+    def test_ensure_sudo_prompts_modal_when_needed(self):
+        from ndev.linux.tui import NdevDashboard
+        app = NdevDashboard()
+        app._needs_sudo = MagicMock(return_value=True)
+        app.push_screen = MagicMock()
+
+        callback = MagicMock()
+        app.ensure_sudo("Privileged Action", callback)
+
+        app.push_screen.assert_called_once()
+        modal, on_dismiss = app.push_screen.call_args[0]
+        self.assertEqual(modal.action_name, "Privileged Action")
+
+        # Simulate user providing password
+        on_dismiss("new_password")
+        self.assertEqual(app._sudo_password, "new_password")
+        callback.assert_called_once_with("new_password")
+
+
 if __name__ == "__main__":
     unittest.main()