Implement privilege separation: write/control commands should require sudo, read commands should not

[mairas]

Problem

Currently, all halpi commands may have inconsistent privilege requirements. Commands that modify firmware settings or control device behavior should require elevated privileges, while read-only commands should work for regular users.

Proposed Behavior

Commands requiring elevated privileges (sudo):

• Configuration writes: halpi config set <key> <value>
• Device control: halpi reboot, halpi shutdown, halpi poweroff
• Firmware updates: halpi flash <firmware.bin>
• Any other commands that modify state or control hardware

Commands allowed for regular users:

• Status/info reads: halpi status, halpi info, halpi version
• Configuration reads: halpi config get <key>, halpi config list
• Monitoring: halpi measurements (or similar read-only monitoring commands)
• Any other read-only commands

Rationale

1. Security: Prevents accidental or unauthorized modifications to system settings
2. Multi-user systems: Allows multiple users to monitor system status without sudo access
3. Automation: Read-only monitoring scripts don't need elevated privileges
4. Best practices: Follows Unix principle of least privilege

Implementation Notes

• The daemon (halpid) communicates with firmware via I2C which requires root access - this is fine
• The CLI (halpi) communicates with daemon via Unix socket
• Unix socket permissions can allow read access for regular users while restricting writes
• Alternative: CLI can check command type and exit with appropriate error if privileges are insufficient

Related

This aligns with standard Unix tool behavior (e.g., systemctl status vs systemctl restart)