Security context

Highlights

Privilege Escalation: 3 prior fixes. Scrutinize any change in this area.

playbooks/roles/wkhtmltopdf/tasks/main.yml: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Privilege Escalation: The passwordless sudoers configuration template previously allowed execution of the entire bench CLI and supervisorctl, permitting unprivileged local attackers to execute arbitrary system operations as root.

Privilege Escalation: Flawed privilege dropping logic relied solely on os.seteuid, leaving supplementary groups and the real UID/GID intact, which allowed spawned processes to retain administrative capability.

Privilege Escalation: Running recursive ownership changes with chown on the tilde symbol under root privilege evaluated to the root user's home directory instead of the application user's path, creating broad structural risks.