[SOLVED] sudo prompt when redirecting stdout/stderr, called from KDE application shortcut

ta0kira · 01-14-2012, 11:31 PM

(I actually solved this while I was writing it, but I'm posting it anyway in case someone else needs the advice.)

I have a script that's called from a KDE application shortcut. This script requires sudo for a command, the output of which is redirected (both standard output and standard error.) This redirection causes sudo to prompt for a password every time, vs. only the first time when I don't redirect both. For example:

Code:

#!/bin/sh
#THIS SHOULD BE SAVED AS $HOME/gui-password.sh

kdialog --password "enter password"

Code:

#!/bin/bash
#THIS SHOULD BE SAVED AS $HOME/show-info.sh


silent()
{
  local command="$1"
  local title="$2"
  shift 2

  eval $command
}


terminal()
{
  local command="$1"
  local title="$2"
  shift 2

  { eval $command; } 2>&1 | xterm -title "$title" -aw -fg white -bg black +sf -mesg -e "cat /dev/fd/3" "$@" 3<&0
}


info()
{
  #THIS IS A CONTRIVED COMMAND, FOR SIMPLICITY

  echo "this is a message for the terminal" 1>&2
  SUDO_ASKPASS="$HOME/gui-password.sh" sudo -A ls /root | kwrite --stdin --line 1
}


#silent info "Show Info" #USING THIS LINE INSTEAD WILL ONLY CAUSE A PROMPT THE FIRST TIME
terminal info "Show Info"

Code:

#THIS SHOULD BE SAVED AS $HOME/show-info.desktop

[Desktop Entry]
Exec=$HOME/show-info.sh
Name[en_US]=Show Info
Name=Show Info
StartupNotify=true
Terminal=false
Type=Application
X-KDE-SubstituteUID=false

The objective is to show standard error in an xterm and open standard output in an editor.

SOLUTION: I made the assumption that redirecting both outputs causes the process to no longer have a controlling terminal, since sudo prompts every time. This lead me to believe that stdin isn't a tty when executed from an application shortcut; therefore, I added exec < /dev/fd/2 just above the call to terminal, and that fixed it! This must be done before the other redirection, while standard error is still a tty. This should cause the sudo process to be associated with the same tty every time it's called from a desktop shortcut, in case multiple shortcuts call sudo, thereby preventing a prompt every time a shortcut is used.

Kevin Barry

PS I didn't really feel like installing one of the graphical sudo programs. I try to get things done with what's on my system already.

EricTRA · 01-15-2012, 01:03 AM

Hello,

Thank you for sharing a very good description of a problem and how you've fixed it. I'm sure it'll help someone.

Kind regards,

Eric

kasl33 · 01-15-2012, 11:46 AM

You could always disable the need or a sudo password completely. In /etc/sudoers, you see this line:

Code:

%admin ALL=(ALL) ALL

You could add NOPASSWD: so it is like the following:

Code:

%admin ALL=(ALL) NOPASSWD: ALL

Of course this presents a security risk for your computer - but I just lock my computer when I leave my desk and it works just fine. I don't believe that it's any more insecure than adding init=/bin/bash to the boot line in GRUB.

ta0kira · 01-15-2012, 12:42 PM

Quote:

Originally Posted by kasl33

You could always disable the need or a sudo password completely. In /etc/sudoers, you see this line:

Thanks for the suggestion! I do that for some things, but these particular shortcuts call scripts that manage an encrypted backup system, and they can potentially retrieve files that only root has access to.
Kevin Barry