Re: libgnomesu [was Re: Proposed modules: my consensus so far]



> - g_spawn_*_with_pipes() cannot be implemented. I can implement it using 
> the modified setuid binaries in libgnomesu, but then I won't be able to 
> implement ssh or sudo support in the future. Both of those programs use 
> stdin (or the tty) to read the password, and to print any status 
> information.

This is true for sudo, but not ssh.  ssh usually reads the password from
stdin, but can also be told to execute an arbitrary program:
SSH_ASKPASS
   If ssh needs a passphrase, it will read the passphrase from the 
   current terminal if it was run from a terminal.  If ssh does not   
   have a terminal associated with it but DISPLAY and SSH_ASKPASS are 
   set, it will execute the program specified by SSH_ASKPASS and open
   an X11 window to read the passphrase.  This is particularly useful 
   when calling ssh from a .Xsession or related script.  (Note that on 
   some machines it may be necessary to redirect the input 
   from /dev/null to make this work.)

The line about "open an X11 window" is a little misleading as it is the
SSH_ASKPASS program that opens the X11 window, not ssh.

Regardless, ssh can be told to read its passphrase from something other
than the controlling terminal.  sudo, however, has no option or
environment variable for telling it to read the password from somewhere
else, although I imagine a patch to do so wouldn't be terribly
difficult.
-- 
Shahms E. King <shahms shahms com>
Multnomah ESD

Public Key:
http://shahms.mesd.k12.or.us/~sking/shahms.asc
Fingerprint:
1612 054B CE92 8770 F1EA  AB1B FEAB 3636 45B2 D75B

Attachment: signature.asc
Description: This is a digitally signed message part



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]