how to make sudo-prompt works with NOPASSWD in /etc/sudoers about sudo-prompt

[overcache]

OK, Thanks for your work!

[jorangreef]

Does sudo-prompt ask for a password and then correctly call your command?

[overcache]

yes it did. but what I expect is:

• ask for password when command doesn't list in sudoers
• run silently when command config with 'NOPASSWD'

[jorangreef]

Thanks @icymind

What does the following return?

1. Open a brand new Terminal window.
2. Run sudo -n echo hello

[overcache]

Thanks for your reply. When I run your command, it just print 'sudo: a password is required' then exit.

🍉  sudo -n echo hello
sudo: a password is required

simon.mbp: ~ 
🍉   

more info, child_process works as expect, it didn't require a password :

const cmd = 'sudo /sbin/route change default "192.168.10.1"'
require('child_process').exec(cmd, {}, (err, stdout, stderr) => {
  if (err) {
    console.error(err)
  } else {
    console.log(stdout, stderr)
  }
})

[jorangreef]

Before asking for a password, sudo-prompt calls sudo -n.

This instructs sudo to run the command if a password is not required (if a sudo session is already established), or else to return the a password is required error.

If we see the error, we then ask the operating system to request administrator privileges on our behalf.

The issue here is that sudo itself is saying a password is required, yet when you run sudo without -n no password is actually required.

[jorangreef]

I am going to close this issue if it's fine with you:

1. sudo itself is giving us the wrong feedback (saying a password is required when your sudoers says otherwise).

2. It is unusual to allow password-less sudo privileges.

3. sudo-prompt is technically still working correctly by requesting administrator privileges, and executing your command.

[overcache]

so, there is no way to run a sudo command beyond a sudo session?

sorry for bothering you.

[jorangreef]

so, there is no way to run a sudo command beyond a sudo session?

No, none that I know of. You could take this issue up with the developers of sudo.

sorry for bothering you.

Anytime, let me know if you have any other questions.

[overcache]

sorry, I still feel confused.

I think the reason why terminal reports error when I run sudo -n echo hello is that echo doesn't config as NOPASSWD

But /sbin/route is different, I successfully execute it in a new terminal:

simon.mbp: ~ 
🍉  sudo -n /sbin/route change default "192.168.10.1"
change net default: gateway 192.168.10.1

Please let me know if I misunderstanding

[jorangreef]

What does the following return?

sudo -k
sudo -n /sbin/route change default "192.168.10.1"

[overcache]

simon.mbp: ~ 
🍉  sudo -k
sudo -n /sbin/route change default "192.168.10.1"
change net default: gateway 192.168.10.1

It execute without error.

[jorangreef]

Ah, thanks I see.

sudo -n is in fact checking your /etc/sudoers and seeing that no password is required for /sbin/route.

There should be no difference between that last command you tried and what sudo-prompt does (except for the -E flag that sudo-prompt also adds)?

See: https://github.com/jorangreef/sudo-prompt/blob/master/index.js#L11

If /usr/bin/sudo -n -E -- /sbin/route change default "192.168.10.1" succeeds, then Attempt() will finish immediately without calling Mac() (which is where we request administrator privileges).

So you should not be seeing a password prompt with sudo-prompt?

[overcache]

simon.mbp: ~
🍉  /usr/bin/sudo -n -E -- /sbin/route change default "192.168.10.1"
sudo: sorry, you are not allowed to preserve the environment

Then I add 'SETENV' to /etc/sudoers as what https://superuser.com/questions/636283/how-to-allow-user-to-preserve-environment-with-sudo/687347 says, now sudo-prompt runs well.

Is it a better solution to offer an option to toggle '-E' flag? When we use sudo, we don't use -E flag offen, isn't it?

[jorangreef]

We had an issue in the past regarding not having the -E flag, see: #20.

I would rather try and preserve environment variables than not.

[bighitbiker3]

I realize this thread is super old, but for some reason I can't get this to honor NOPASSWD, nor can I find the sudo -n call in the source code for this library. Did that get nixed sometime in the past few years?