Handling Casks #40

DomT4 · 2021-02-26T01:40:11Z

Issue:

Currently Casks that use sudo to upgrade can block this command from executing successfully when people use autoupdate to execute upgrade on their behalf, because of the hang on silently waiting for sudo authorisation.
Homebrew explicitly does not support launching brew upgrade with sudo, immediately bailing on the command, meaning we can't execute the Cask upgrade command as root to work around the issue.

Potential Fix:

Using Homebrew's API to work out which Casks are outdated, and which of those Casks need sudo usage to upgrade, only passing those non-sudo Casks to the upgrade command.

Problems with Fix:

Likely to be computationally expensive, making the command very slow to execute.
Leaves sudo Casks behind intentionally; would need to find a way to gracefully notify the user to their presence & reason for not upgrading.
Leaning on Homebrew's API so heavily to work out what casks are outdated and which of those need sudo has a very real potential to be fragile and prone to breaking.
Quite a lot of work for something I'm not sure how widely is a use-case yet.

Hacky Temporary Workaround

Use SUDO_ASKPASS as Homebrew seems to intentionally support that for non-interactive installs, and works when tested locally.
I don't really want to settle on that as a long-term solution because I'm a tad uncomfortable asking people to simply leave their sudo passwords sat on the filesystem unguarded in plaintext.

Related Issues:

Question about casks that require admin privileges #35

The text was updated successfully, but these errors were encountered:

whazor · 2021-03-22T08:45:23Z

Maybe it is possible to make a custom brew-autoupdate user with special sudo rights that can only install casks?

whazor · 2021-03-22T09:37:29Z

Follow multi-user homebrew guide: https://medium.com/@leifhanack/homebrew-multi-user-setup-e10cb5849d59
Running autoupdate service under a different use: https://apple.stackexchange.com/a/93174
Allowing sudo without password: add file under /private/etc/sudoers.d/brew-sudo with brew ALL=(ALL) NOPASSWD: ALL

JarryShaw · 2021-04-18T14:16:57Z

Use SUDO_ASKPASS as Homebrew seems to intentionally support that for non-interactive installs, and works when tested locally.

Actually I had also encountered such problem when implementing my own auto-updater for Mac, MacDaily. So basically, my solution was to temporarily set SUDO_ASKPASS to a tailored AppleScript program at runtime to request sudo password on the fly.

My implementation for the AppleScript is at macdaily/res/askpass.applescript, which was originally inspired from another Homebrew formula called ssh-askpass.

CiaronHowell · 2021-07-30T13:51:32Z

Out of curiosity @JarryShaw , how hard was it to implement? Tempted to look further into it and attempt it myself, especially if no one else has got around to it yet :)

marlonrichert · 2021-08-02T18:28:33Z

Hacky Temporary Workaround

Use SUDO_ASKPASS as Homebrew seems to intentionally support that for non-interactive installs, and works when tested locally.

I don't really want to settle on that as a long-term solution because I'm a tad uncomfortable asking people to simply leave their sudo passwords sat on the filesystem unguarded in plaintext.

Setting NOPASSWD in /etc/sudoers might be a better alternative.

JarryShaw · 2021-08-05T13:14:14Z

Out of curiosity @JarryShaw , how hard was it to implement? Tempted to look further into it and attempt it myself, especially if no one else has got around to it yet :)

@CiaronHowell It was quite a simple task with some tests lol
as you may have known, AppleScript is never well documented but still easy to understand...

Setting NOPASSWD in /etc/sudoers might be a better alternative.

I don't quite like this idea... 🔗
and I suppose doing so may require either user manually editing their /etc/sudoers or the Command itself modifying the file when installation -- seems not very brew-ish

whazor · 2021-08-05T13:40:56Z

NOPASSWD should be acceptable as you would only allow the auto update command to be executed. Installation should be a manual action to make the user aware, auto updating with sudo rights is inherently a security risk. That is also why I would understand for brew not to support this. However I hope it will exist anyway, perhaps unofficially.

CiaronHowell · 2021-08-06T15:08:21Z

@CiaronHowell It was quite a simple task with some tests lol
as you may have known, AppleScript is never well documented but still easy to understand...

Thank you, I'll give it a go soon 😄

regulskimichal · 2021-10-22T16:31:22Z

I use PAM for sudo. The issue I encounter is that when autoupdater spawns a new process with sudo, the prompt does not include any useful information about the command which supposed to run. As a Linux user, MacOS messages are not useful at all. I would like to know what exactly sudo tries to run, not just that it wants to escalate permissions. If we were able to change this behavior, PAM authentication would be a perfect solution IMO.

Omoeba · 2021-11-15T18:10:54Z

I made a one-liner script to store my password in the keychain following this guide. It should be a lot more secure than storing your password in plaintext.

regulskimichal · 2021-11-16T13:59:09Z

I made a one-liner script to store my password in the keychain following this guide. It should be a lot more secure than storing your password in plaintext.

Could you share details of how you use that script?

Omoeba · 2021-11-17T22:27:51Z

I made a one-liner script to store my password in the keychain following this guide. It should be a lot more secure than storing your password in plaintext.

Could you share details of how you use that script?

I added export SUDO_ASKPASS="/Users/$(whoami)/getpass.sh" to "/Users/$(whoami)/Library/Application Support/com.github.domt4.homebrew-autoupdate/brew_autoupdate". The script is named getpass.sh.

NikSWE · 2021-11-18T15:36:04Z

My implementation for the AppleScript is at macdaily/res/askpass.applescript, which was originally inspired from another Homebrew formula called ssh-askpass.

This could be a potential solution if we're able to capture which cask requires sudo privilege

SwiftWinds · 2022-05-29T01:27:34Z

I made a one-liner script to store my password in the keychain following this guide. It should be a lot more secure than storing your password in plaintext.

note that the script in the guide must be slightly modified, since SUDO_ASKPASS expects a script that spits just your password to standard out when invoked.

Here's what my getpass.sh contained:

pw_name="CLI"
pw_account="matt"

if ! cli_password=$(security find-generic-password -w -s "$pw_name" -a "$pw_account"); then
  echo "error $?"
  exit 1
fi

echo "$cli_password"

hybras · 2022-07-31T15:15:54Z

I use PAM for sudo .. the prompt does not include any useful information about the command which supposed to run

I was going to suggest this, but you beat me to to it! I check which process is requesting sudo access with sudo procs --tree sudo. I'm sure there's an equivalent incantation using ps. And yes, I see the irony of using sudo to check where sudo is being invoked.

tmillr · 2022-10-11T21:48:06Z

I wonder if pinentry could be used via SUDO_ASKPASS? I believe it doesn't require a terminal for password input as it uses its own gui prompt. This is what the gpgagent daemon uses (or can be setup to use).

SwiftWinds · 2023-06-13T21:52:50Z

TL;DR solution (using getpass.sh)

(assuming your username is "mateowang" and password is "password123")

security add-generic-password -s 'CLI' -a 'mateowang' -w 'password123' -T /usr/bin/security 1
run security find-generic-password -w -s 'CLI' -a 'mateowang' and confirm that it outputs 'password123' 1

write:

pw_name="CLI"
pw_account="mateowang"

if ! cli_password=$(security find-generic-password -w -s "$pw_name" -a "$pw_account"); then
  echo "error $?"
  exit 1
fi

echo "$cli_password"

to ~/getpass.sh 2

chmod +x ~/getpass.sh
add export SUDO_ASKPASS="/Users/$(whoami)/getpass.sh" to "/Users/$(whoami)/Library/Application Support/com.github.domt4.homebrew-autoupdate/brew_autoupdate". (Note: you may have to :w! if you're using vim as it is a read-only file.) 3

benwaco · 2023-06-17T04:05:09Z

TL;DR solution (using getpass.sh)

(assuming your username is "mateowang" and password is "password123")
security add-generic-password -s 'CLI' -a 'mateowang' -w 'password123' -T /usr/bin/security 1

run security find-generic-password -w -s 'CLI' -a 'mateowang' and confirm that it outputs 'password123' 1
write:
pw_name="CLI"
pw_account="mateowang"

if ! cli_password=$(security find-generic-password -w -s "$pw_name" -a "$pw_account"); then
  echo "error $?"
  exit 1
fi

echo "$cli_password"
to ~/getpass.sh 2
chmod +x ~/getpass.sh

add export SUDO_ASKPASS="/Users/$(whoami)/getpass.sh" to "/Users/$(whoami)/Library/Application Support/com.github.domt4.homebrew-autoupdate/brew_autoupdate". (Note: you may have to :w! if you're using vim as it is a read-only file.) 3

Any security risks when using this?

conuaunoc · 2023-08-03T21:30:29Z

Setting NOPASSWD in /etc/sudoers might be a better alternative.

I don't quite like this idea... 🔗 and I suppose doing so may require either user manually editing their /etc/sudoers or the Command itself modifying the file when installation -- seems not very brew-ish

You don't need to modify /etc/sudoers, just create a new file in /private/etc/sudoers.d

toobuntu · 2023-08-29T01:50:04Z

I wonder if pinentry could be used via SUDO_ASKPASS? I believe it doesn't require a terminal for password input as it uses its own gui prompt. This is what the gpgagent daemon uses (or can be setup to use).

Yes, it can. milanvarady/Applite#5 (comment)

swissbuechi · 2023-10-25T07:35:08Z

I wonder if pinentry could be used via SUDO_ASKPASS? I believe it doesn't require a terminal for password input as it uses its own gui prompt. This is what the gpgagent daemon uses (or can be setup to use).

Yes, it works and is in my opinion the most secure and user-friendly solution.

Setup

Dependency

brew install pinentry-mac

Create Password Script

nano $HOME/getpass.sh

getpass.sh:

#!/bin/bash
PW="$(printf "%s\n" "SETOK OK" "SETCANCEL Cancel" "SETDESC homebrew-autoupdate needs your admin password to complete the task" "SETPROMPT Enter Password:$
echo "$PW"

Invoke Password Script when homebrew-autoupdate runs

sudo nano "/Users/$(whoami)/Library/Application Support/com.github.domt4.homebrew-autoupdate/brew_autoupdate"

add: export SUDO_ASKPASS=${HOME}/getpass.sh before the last line.

Test

Test Password Dialog

export SUDO_ASKPASS=${HOME}/getpass.sh

sudo -i -A

Test homebrew-autoupdate

launchctl start com.github.domt4.homebrew-autoupdate

tail -f ~/Library/Logs/com.github.domt4.homebrew-autoupdate/com.github.domt4.homebrew-autoupdate.out

mietzen · 2023-10-25T10:57:13Z

I wonder if pinentry could be used via SUDO_ASKPASS? I believe it doesn't require a terminal for password input as it uses its own gui prompt. This is what the gpgagent daemon uses (or can be setup to use).

Yes, it works and is in my opinion the most secure and user-friendly solution.

Setup

Dependency

brew install pinentry-mac

Create Password Script

nano $HOME/getpass.sh

getpass.sh:
#!/bin/bash
PW="$(printf "%s\n" "SETOK OK" "SETCANCEL Cancel" "SETDESC homebrew-autoupdate needs your admin password to complete the task" "SETPROMPT Enter Password:$
echo "$PW"
Invoke Password Script when homebrew-autoupdate runs

sudo nano "/Users/$(whoami)/Library/Application Support/com.github.domt4.homebrew-autoupdate/brew_autoupdate"

add: export SUDO_ASKPASS=${HOME}/getpass.sh before the last line.

Test

Test Password Dialog

export SUDO_ASKPASS=${HOME}/getpass.sh

sudo -i -A
### Test homebrew-autoupdate `launchctl start com.github.domt4.homebrew-autoupdate `
tail -f ~/Library/Logs/com.github.domt4.homebrew-autoupdate/com.github.domt4.homebrew-autoupdate.out

I guess you could also use TouchID: https://github.com/jorgelbg/pinentry-touchid

swissbuechi · 2023-10-25T12:42:49Z

I wonder if pinentry could be used via SUDO_ASKPASS? I believe it doesn't require a terminal for password input as it uses its own gui prompt. This is what the gpgagent daemon uses (or can be setup to use).

Yes, it works and is in my opinion the most secure and user-friendly solution.

Setup

Dependency

brew install pinentry-mac

Create Password Script

nano $HOME/getpass.sh
getpass.sh:
#!/bin/bash
PW="$(printf "%s\n" "SETOK OK" "SETCANCEL Cancel" "SETDESC homebrew-autoupdate needs your admin password to complete the task" "SETPROMPT Enter Password:$
echo "$PW"
Invoke Password Script when homebrew-autoupdate runs

sudo nano "/Users/$(whoami)/Library/Application Support/com.github.domt4.homebrew-autoupdate/brew_autoupdate"
add: export SUDO_ASKPASS=${HOME}/getpass.sh before the last line.

Test

Test Password Dialog

export SUDO_ASKPASS=${HOME}/getpass.sh
sudo -i -A

Test homebrew-autoupdate

launchctl start com.github.domt4.homebrew-autoupdate
tail -f ~/Library/Logs/com.github.domt4.homebrew-autoupdate/com.github.domt4.homebrew-autoupdate.out
I guess you could also use TouchID: https://github.com/jorgelbg/pinentry-touchid

It would be awesome if we could use the touch ID.
But I don't think it's as simple as using pinetry-mac.
From where would pinetry-touchid receive the sudo password?
Maybe you could manually store the password in the keyring and access the secret via pinetry-touchid.
Also it would not work for older macs without touch ID.

swissbuechi · 2023-11-11T12:51:13Z

The argument --sudo from PR #110 did solve this issue.

@DomT4
I believe you can now close?

toobuntu · 2023-11-12T00:31:12Z

The argument --sudo from PR #110 did solve this issue.

@swissbuechi
Thank you for this very useful addition to Homebrew Autoupdate!

Out of curiosity, why do you invoke a subshell and then echo the password, when it works as well to not do that?

swissbuechi · 2023-11-12T01:22:08Z

@toobuntu

Thank you for this very useful addition to Homebrew Autoupdate!

I'm glad you like it 👍🏻

Out of curiosity, why do you invoke a subshell and then echo the password, when it works as well to not do that?

The `brew autoupdate start --sudo` command does generate the content of a script, that will invoke pinentry and echo out the pw. The command will then set the `SUDO_ASKPASS` environment variable to the path of this script. Every command which supports `SUDO_ASKPASS` will now invoke this script automatically.

EDIT:

@toobuntu was right, I did not understand his initial question about invoking a subshell, he already fixed it in PR: #128

swissbuechi · 2023-12-29T12:45:19Z

@DomT4 I think this issue could now be closed.

DomT4 added enhancement help wanted cask labels Feb 26, 2021

DomT4 self-assigned this Feb 26, 2021

DomT4 mentioned this issue Feb 26, 2021

Question about casks that require admin privileges #35

Closed

cpsauer mentioned this issue Apr 10, 2021

Notify on failure #42

Closed

DomT4 pinned this issue Apr 15, 2021

DomT4 mentioned this issue Apr 15, 2021

"Logs not found; cannot show summary!" #37

Closed

toobuntu mentioned this issue Aug 29, 2023

Handle installs that require password milanvarady/Applite#5

Closed

swissbuechi mentioned this issue Oct 26, 2023

password gui with pinentry-mac for handling Casks that require sudo #110

Merged

DomT4 closed this as completed Dec 29, 2023

toobuntu mentioned this issue Dec 31, 2023

sudo_gui_script_contents: add timeout, remove unnecessaries #128

Merged

github-actions bot added the outdated label Feb 2, 2024

github-actions bot locked as resolved and limited conversation to collaborators Feb 2, 2024

DomT4 unpinned this issue Feb 16, 2024

Handling Casks #40

Handling Casks #40

Comments

DomT4 commented Feb 26, 2021 • edited

Issue:

Potential Fix:

Problems with Fix:

Hacky Temporary Workaround

whazor commented Mar 22, 2021

whazor commented Mar 22, 2021

JarryShaw commented Apr 18, 2021

CiaronHowell commented Jul 30, 2021

marlonrichert commented Aug 2, 2021 • edited

Hacky Temporary Workaround

JarryShaw commented Aug 5, 2021

whazor commented Aug 5, 2021

CiaronHowell commented Aug 6, 2021

regulskimichal commented Oct 22, 2021

Omoeba commented Nov 15, 2021

regulskimichal commented Nov 16, 2021

Omoeba commented Nov 17, 2021

NikSWE commented Nov 18, 2021 • edited

SwiftWinds commented May 29, 2022

hybras commented Jul 31, 2022

tmillr commented Oct 11, 2022 • edited

SwiftWinds commented Jun 13, 2023 • edited

TL;DR solution (using getpass.sh)

(assuming your username is "mateowang" and password is "password123")

benwaco commented Jun 17, 2023

TL;DR solution (using getpass.sh)

(assuming your username is "mateowang" and password is "password123")

conuaunoc commented Aug 3, 2023

toobuntu commented Aug 29, 2023

swissbuechi commented Oct 25, 2023 • edited

Setup

Dependency

Create Password Script

Invoke Password Script when homebrew-autoupdate runs

Test

Test Password Dialog

Test homebrew-autoupdate

mietzen commented Oct 25, 2023 • edited

Setup

Dependency

Create Password Script

Invoke Password Script when homebrew-autoupdate runs

Test

Test Password Dialog

swissbuechi commented Oct 25, 2023

Setup

Dependency

Create Password Script

Invoke Password Script when homebrew-autoupdate runs

Test

Test Password Dialog

Test homebrew-autoupdate

swissbuechi commented Nov 11, 2023

toobuntu commented Nov 12, 2023

swissbuechi commented Nov 12, 2023 • edited

swissbuechi commented Dec 29, 2023

DomT4 commented Feb 26, 2021 •

edited

marlonrichert commented Aug 2, 2021 •

edited

NikSWE commented Nov 18, 2021 •

edited

tmillr commented Oct 11, 2022 •

edited

SwiftWinds commented Jun 13, 2023 •

edited

swissbuechi commented Oct 25, 2023 •

edited

mietzen commented Oct 25, 2023 •

edited

swissbuechi commented Nov 12, 2023 •

edited