Add support for `-A` (askpass) commandline switch

[allisonkarlitskaya]

hi,

Cockpit uses sudo to gain root privileges for users performing actions via the web interface. We definitely need askpass support: we forward the prompt to the user, asking for the password, and passing it back. We can't do that with a pseudoterminal forwarded to the user because we also support caching the login password and using that.

See cockpit-project/cockpit#22305 for the original report on our side.

Thanks!

Originally posted by @allisonkarlitskaya in #129

[squell]

One initial question to help us in our discussion on this: since you are prepared to cache the password yourself, would an alternative approach using sudo --reset-timestamp --non-interactive --stdin be an alternative solution? E.g. providing the password to the standard input of sudo?

[allisonkarlitskaya]

Does this mean that we'd use sudo --reset-timestamp followed by a normal sudo invocation, or does it mean that we'd run the command with --stdin?

If the first one: what if the admin has disabled credential caching? And how do we get the prompt? Is it printed to stdout? How do we know when the prompt is done? And what if there is more than one prompt (as is the case with 2FA, for example)?

If the second one: We definitely need stdin for our own purposes so that wouldn't be a good solution for us.

[squell]

We're going to take this feature in consideration (e.g. first identify the difficulty of implementing this). The general idea seems pretty straightforward: spawn a process with ordinary user rights (and being sudo, we already have the code for that) and hook its standard output into our PAM process.

[crschnick]

Hey, just wanted to chime in and say that other projects require the askpass functionality as well to work with sudo (I for example maintain https://github.com/xpipe-io/xpipe). Without the askpass functionality, it becomes very difficult to use sudo in an automated way.

Normal stdin with --stdin is quite limited as the calling application needs to make sure to supply the secret to the respective stdin. With an askpass process, the application just needs to print the secret to stdout, which is far easier to accomplish.

[jnsgruk]

This was recently mentioned on the Ubuntu Discourse as something that would affect the Cockpit package on Ubuntu, too: https://discourse.ubuntu.com/t/adopting-sudo-rs-by-default-in-ubuntu-25-10/60583/27?u=jnsgruk

[elfmz]

Here is another application needing sudo -A: elfmz/far2l#2903