Should passwordless-sudo renewal require renewed user consent?

[SorenHJohansen]

I noticed a potentially interesting security-design question in omarchy-sudo-passwordless.

Observed behavior

When passwordless sudo is already active, the command can extend the existing grant without another password or interactive confirmation.

For example:

omarchy-sudo-passwordless 5

This creates a temporary NOPASSWD: ALL grant.

While that grant is active, running:

omarchy-sudo-passwordless 1440

from the same user context extends the expiry without another confirmation.

The expiry moved from roughly 5 minutes away to 24 hours away.

Why this is interesting

The initial operation involves explicit user interaction and a duration choice:

User confirms
↓
Passwordless sudo for N minutes

However, once the grant is active, any process running as that user can effectively change the deadline:

Passwordless sudo active
↓
Any process running as the user
↓
Can renew the grant
↓
Up to 1440 minutes

This means the originally selected duration is not necessarily a hard upper bound on how long the authorization remains active.

Example

A user could intentionally grant an AI agent passwordless sudo for 15 minutes.

Near the end of that period, another agent or process running under the same account could renew the grant and extend the authorization without requiring the user to interact again.