Document sudo --reset-timestamp behavior

[AliGhahraei]

Verification

• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.

Provide a detailed description of the proposed feature

Document the --reset-timestamp behavior as it can cause unexpected password re-prompts in interactive shells and scripts for people who don't know about it. My initial suggestion would be to add it to the post installation steps, the FAQ or both, but there could be a better place.

What is the motivation for the feature?

The timestamp resetting is a security feature added in this PR to prevent privilege escalation. However, it can cause unexpected issues if someone runs a script using brew or includes a brew command in their shell config and hasn't heard about it.

I ran into it today after struggling to pinpoint the root cause and I found multiple issues opened by others:

• brew breaks sudo password cache #17905
• sudo not working anymore after running any brew command #17915
• sudo timestamp reset may break scripts #17912
• whenever run fish -c "sudo -v", it requires password every time in same terminal session fish-shell/fish-shell#11064

How will the feature be relevant to at least 90% of Homebrew users?

The feature is always present, so everyone can benefit from it being documented.

What alternatives to the feature have been considered?

As far as i could find, only the removal of the feature has been proposed. As this is not a possibility according to the Homebrew developers, I propose to document it instead.

[MikeMcQuaid]

@AliGhahraei Thanks! What documentation did you look at/web searches did you make to try and find this out?

[MikeMcQuaid]

Also CC @woodruffw @p-linnane in case you think it'd be acceptable to tone down this behaviour a bit to e.g. before anywhere that Homebrew or external commands/taps could run sudo?

[AliGhahraei]

So my shell had this in its configuration:

eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"

I didn't know about this feature at the time, but I noticed that my password was being reset after every sudo invocation. I guess I could have tried to re-add my config line by line, but I thought either my sudo configuration or an external program was the issue instead.

I found out about the --reset-timestamp flag by chance and I used this to find out what was triggering it:

strace -f -e execve fish 2>&1 | grep -B10 'reset-timestamp'

Once it showed the brew call with the flag, I searched for reset-timestamp in the repo and found out about the feature with the CR where it was added. I also found the rest of the links I posted.

I added the eval line to my config when I was reading the post-installation steps, that's why I'm suggesting to document this feature there.

I specifically didn't request a removal due to the other closed issues, but I guess toning it down would work for me as well. Either way, it would help to document the outcome.

[AliGhahraei]

I guess the Homebrew installation instructions for updating the sell configuration could mention this as well.