CLI Overview

[pvdrz]

Since we decided we don't need to be a perfect, in-place replacement for sudo, we should consider removing some of the CLI options that we added. I'm opening this issue to keep track of this discussion.

Already implemented

• --

• -h, --help

• -u user, --user=user

• -g group, --group=group

• -V, --version

• -D directory, --chdir=directory

• -i, --login (CC -i and -s flag are not supported properly by the CLI #225)

• -s, --shell

• -S, --stdin (PR Feature pam tty #224 )

• -n, --non-interactive

• -k, --reset-timestamp

• -K, --remove-timestamp

• -v, --validate (always asking for password) (CC implement the --validate flag #395)

• -p prompt, --prompt=prompt

• -v, --validate (optionally asking for password) (CC Make --validate aware of NOPASSWD #439)

• -l, --list (CC implement sudo --list #658)

• -U user, --other-user=user (together with -l)

• env variable declarations (CC Add env variable declarations to the CLI #917, Add SETENV support #932)

• --preserve-env=list

• -B, --bell (CC -B/--bell flag #1028)

• -e, --edit (CC Support for sudo -e (and sudoedit) #762)

Planned

• -A, --askpass

To be decided

• -P, --preserve-groups
• -b, --background

Doubtful

• -E, --preserve-env
• -C num, --close-from=num
• -T timeout, --command-timeout=timeout
• -H, --set-home

Highly doubtful

• -h host, --host=host

[allisonkarlitskaya]

hi,

Cockpit uses sudo to gain root privileges for users performing actions via the web interface. We definitely need askpass support: we forward the prompt to the user, asking for the password, and passing it back. We can't do that with a pseudoterminal forwarded to the user because we also support caching the login password and using that.

See cockpit-project/cockpit#22305 for the original report on our side.

Thanks!

[squell]

Hi! Thanks for requesting this. Could you open this as a separate issue? That makes it easier to track.