Device Access

Approve scoped admin access

Bootstrap a root-owned, allowlisted helper once. After approval, the agent can perform only the listed admin actions without asking you to retype sudo commands.

Current target

OnePlus 6T · Ubuntu Touch

Role: experimental future daily driver. Samsung Fold remains the stable current phone.

What this grants

Switch Waydroid between VANILLA and GAPPS images.
Upgrade Waydroid.
Start, stop, or restart the Waydroid container.
Enable linger for the phablet user.
Switch Ubuntu Touch to the stable OTA channel.

Not granted: arbitrary root shell, package installation, file deletion, or unrestricted sudo.

One-time approval

The helper is already staged on the OnePlus at ~/3dvr-admin.new.

sudo install -m 0755 ~/3dvr-admin.new /usr/local/sbin/3dvr-admin

Expected helper SHA-256: f54454db63fe2ff4dd4a374344b4b2deaf2933697f261a04262afe55b4cfe467

After approval

sudo -n /usr/local/sbin/3dvr-admin waydroid-init-gapps
sudo -n /usr/local/sbin/3dvr-admin waydroid-upgrade
sudo -n /usr/local/sbin/3dvr-admin waydroid-container-restart

These are examples of the fixed allowlist. The agent cannot pass arbitrary shell commands through this helper.

Revoke

To remove passwordless access later, remove the sudoers rule locally:

sudo rm /etc/sudoers.d/3dvr-admin

Back to guides Access registry Abilities Return to Portal