trifectatechfoundation / sudo-rs

A memory safe implementation of sudo and su.
Other
2.9k stars 79 forks source link

weird sudo behavior with a tty and stderr #622

Closed pvdrz closed 1 year ago

pvdrz commented 1 year ago

I've noticed that neither sudo-rs nor the original sudo pass the closes_open_file_descriptors_with_tty test where

echo topsecret >/tmp/secret.txt
exec 42<>/tmp/secret.txt

sudo bash -c 'cat <&42'

is run and then the test checks that the command exits with status code 1 and if if stderr contains "42: Bad file descriptor", this last part is the one that fails. However, If I run that script myself it works as expected on both versions.

Edit: This is the test https://github.com/memorysafety/sudo-rs/blob/62b21ad8b76e0cf49e9a2685f713ba538ec2799a/test-framework/sudo-compliance-tests/src/misc.rs#L38-L69

xy2i commented 1 year ago

When tty(true), there's no output in stderr. Minimized:

 #[test]
fn docker_stdout_with_tty() -> Result<()> {
    let script_path = "/tmp/script.bash";
    let env = Env(SUDOERS_ALL_ALL_NOPASSWD)
        .file(script_path, "echo foo 1>&2")
        .build()?;

    let output = Command::new("bash")
        .arg(script_path)
        .tty(true)
        .output(&env)?;

    assert!(output.status().success());
    assert_contains!(output.stderr(), "foo");

    Ok(())
}

"foo" is in stdout instead of stderr.