Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for doas in addition to (instead of) sudo #3534

Closed
wrbbz opened this issue Feb 26, 2024 · 7 comments
Closed

Support for doas in addition to (instead of) sudo #3534

wrbbz opened this issue Feb 26, 2024 · 7 comments
Labels
feature New feature or enhancement request stale Issue is stale and will be closed

Comments

@wrbbz
Copy link

wrbbz commented Feb 26, 2024

Please describe your use case / problem.
I'm really like telepresence and its features. I'm using it all the time. But, sadly, I can connect with one line only on MacOS machine. Because on my primary Linux machine I'm using doas instead of sudo. Thus, to run telepresence as I do on MacOS, I have to run daemon-foreground and only after that - telepresence connect:

❯ doas telepresence daemon-foreground <logging dir> <config dir>

And only after that I can connect
Looks like some workarounds for me.
I even tried to make symlink from doas to sudo. However, it did not work, I suppose, because there is no option --non-interactive in doas. Only -n which does the same.

Describe the solution you'd like
It could be nice to have a possibility to override privileges escalation tool. For example, by default it could be sudo, but in some cases you can override it to doas.

Versions (please complete the following information)

❯ telepresence version
OSS Client     : v2.18.0
Root Daemon    : not running
OSS User Daemon: v2.18.0
Traffic Manager: not connected
@thallgren
Copy link
Member

Did you try using a sudoers file that will allow you do sudo without password? E.g.

%admin ALL=(ALL) NOPASSWD: ALL

@ejiek
Copy link

ejiek commented Feb 27, 2024

@thallgren I'm sorry, but I'm a bit confused by your suggestion =\

sudoers file is used by sudo which @wrbbz doesn't have because he uses an alternative - doas.

doas has a similar file /etc/doas.conf but it isn't helpful because telepresence calls sudo binary.

It's not possible to work around it with a simple sudo to doas alias because they have different sets of arguments.
telepresence uses sudo with --non-interactive argument while doas doesn't have this exact argument so it fails.

doas has somewhat similar -n:

Non interactive mode, fail if the matching rule doesn't have
the nopass option.

The problem boils down to a hard sudo dependency in startInBackgroundAsRoot function.
I see at least two possible solutions:

  • make privilege escalation command user-configurable
  • hardcode both utils: try to look for sudo, in case of failure look for doas, then fail miserably

ps. I'm also a doas user and lack sudo on my machine.
pps. I'm happy to implement this alternative privilege escalation feature after figuring out the solution here.

@thallgren
Copy link
Member

@ejiek I misunderstood the problem. Thought it was about the password prompt.

This looks like a good candidate for a PR contribution that makes the command configurable from config.yml. Would you be interested in trying that?

@ejiek
Copy link

ejiek commented Mar 5, 2024

@thallgren it absolutely fine & thanks for the suggestion =]

Going to try if it even works by just hardcoding doas with relevant arguments. If it does I'll take a look at the config file.

@ejiek
Copy link

ejiek commented Mar 14, 2024

Good news, swapping sudo for doas and changing non interactive argument works.
Now we have to figure out how to integrate it into config.
PR is brewing.

@cindymullins-dw cindymullins-dw added the feature New feature or enhancement request label Apr 22, 2024
Copy link

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment, or this will be closed in 7 days.

@github-actions github-actions bot added the stale Issue is stale and will be closed label Aug 16, 2024
@thallgren
Copy link
Member

This will not be implemented, because doas have no support for options like --background or --prompt which are needed to support the improvements in #3669.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature New feature or enhancement request stale Issue is stale and will be closed
Projects
None yet
Development

No branches or pull requests

4 participants