Use sudo when necessary for certutil (Ubuntu 16.04 at least), fixes #192

go.mod

@@ -2,6 +2,7 @@ module github.com/FiloSottile/mkcert
 
 require (
 	golang.org/x/net v0.0.0-20180627171509-e514e69ffb8b
+	golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a
 	golang.org/x/text v0.3.0 // indirect
 	howett.net/plist v0.0.0-20181124034731-591f970eefbb
 	software.sslmate.com/src/go-pkcs12 v0.0.0-20180114231543-2291e8f0f237

go.sum

@@ -4,6 +4,8 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 golang.org/x/net v0.0.0-20180627171509-e514e69ffb8b h1:oXs/nlnyk1ue6g+mFGEHIuIaQIT28IgumdSIRMq2aJY=
 golang.org/x/net v0.0.0-20180627171509-e514e69ffb8b/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a h1:aYOabOQFp6Vj6W1F80affTUvO9UxmJRx8K0gsfABByQ=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

is_writable.go

@@ -0,0 +1,14 @@
+// +build linux darwin !windows
+
+package main
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+func IsWritable(path string) bool {
+	if err := unix.Access(path, unix.W_OK); err == nil {
+		return true
+	}
+	return false
+}

is_writable_windows.go

@@ -0,0 +1,26 @@
+// +build windows
+
+package main
+
+import (
+	"os"
+)
+
+// thanks to https://stackoverflow.com/a/49148866/215713
+func IsWritable(path string) bool {
+	info, err := os.Stat(path)
+	if err != nil {
+		return false
+	}
+
+	err = nil
+	if !info.IsDir() {
+		return false
+	}
+
+	// Check if the user bit is enabled in file permission
+	if info.Mode().Perm()&(1<<(uint(7))) == 0 {
+		return false
+	}
+	return true
+}

truststore_nss.go

@@ -69,7 +69,7 @@ func (m *mkcert) checkNSS() bool {
 		return false
 	}
 	success := true
-	if m.forEachNSSProfile(func(profile string) {
+	if m.forEachNSSProfile(func(profile string, path string) {
 		err := exec.Command(certutilPath, "-V", "-d", profile, "-u", "L", "-n", m.caUniqueName()).Run()
 		if err != nil {
 			success = false
@@ -81,10 +81,16 @@ func (m *mkcert) checkNSS() bool {
 }
 
 func (m *mkcert) installNSS() bool {
-	if m.forEachNSSProfile(func(profile string) {
-		cmd := exec.Command(certutilPath, "-A", "-d", profile, "-t", "C,,", "-n", m.caUniqueName(), "-i", filepath.Join(m.CAROOT, rootName))
+	if m.forEachNSSProfile(func(profile string, path string) {
+		// certutil must be sudoed on Ubuntu 16.04
+		cmdArgs := []string{certutilPath, "-A", "-d", profile, "-t", "C,,", "-n", m.caUniqueName(), "-i", filepath.Join(m.CAROOT, rootName)}
+		cmd := exec.Command(certutilPath, cmdArgs[1:]...)
+
+		if !IsWritable(path) {
+			cmd = commandWithSudo(cmdArgs...)
+		}
 		out, err := cmd.CombinedOutput()
-		fatalIfCmdErr(err, "certutil -A", out)
+		fatalIfCmdErr(err, strings.Join(cmdArgs, " "), out)
 	}) == 0 {
 		log.Printf("ERROR: no %s security databases found", NSSBrowsers)
 		return false
@@ -98,29 +104,36 @@ func (m *mkcert) installNSS() bool {
 }
 
 func (m *mkcert) uninstallNSS() {
-	m.forEachNSSProfile(func(profile string) {
+	m.forEachNSSProfile(func(profile string, path string) {
 		err := exec.Command(certutilPath, "-V", "-d", profile, "-u", "L", "-n", m.caUniqueName()).Run()
 		if err != nil {
 			return
 		}
-		cmd := exec.Command(certutilPath, "-D", "-d", profile, "-n", m.caUniqueName())
+
+		cmdArgs := []string{certutilPath, "-D", "-d", profile, "-n", m.caUniqueName()}
+		cmd := exec.Command(certutilPath, cmdArgs[1:]...)
+		if !IsWritable(path) {
+			cmd = commandWithSudo(cmdArgs...)
+		}
+
 		out, err := cmd.CombinedOutput()
-		fatalIfCmdErr(err, "certutil -D", out)
+
+		fatalIfCmdErr(err, strings.Join(cmdArgs, " "), out)
 	})
 }
 
-func (m *mkcert) forEachNSSProfile(f func(profile string)) (found int) {
+func (m *mkcert) forEachNSSProfile(f func(profile string, path string)) (found int) {
 	profiles, _ := filepath.Glob(FirefoxProfile)
 	profiles = append(profiles, nssDBs...)
 	for _, profile := range profiles {
 		if stat, err := os.Stat(profile); err != nil || !stat.IsDir() {
 			continue
 		}
 		if pathExists(filepath.Join(profile, "cert9.db")) {
-			f("sql:" + profile)
+			f("sql:"+profile, profile)
 			found++
 		} else if pathExists(filepath.Join(profile, "cert8.db")) {
-			f("dbm:" + profile)
+			f("dbm:"+profile, profile)
 			found++
 		}
 	}