# The unprivileged API may invoke only the fixed, validating transaction helper.
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction activate txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction confirm txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction rollback txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction status txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction activate ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction confirm ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction rollback ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-transaction status ipt_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-dns-transaction activate dns_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-dns-transaction rollback dns_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-dns-transaction status dns_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-hostname-transaction apply host_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-hostname-transaction rollback host_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-hostname-transaction status host_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-iptables-validate validate iptval_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-nft-validate validate txn_[0-9a-f]*
firewall-api ALL=(root) NOPASSWD: /usr/local/sbin/firewall-transaction health txn_[0-9a-f]*
