If I do:
sudo cat /etc/resolv.conf | less It will prompt me for the password, even though less (presumably) takes stdin. Over what fd's is the password prompt shown and how does it get the input back?
Add a comment |
3 Answers
Actually, a typical invocation of sudo does not read the password from stdin at all. Instead, sudo will directly access the controlling terminal (a tty or pty, via the /dev/tty special file) and output the prompt and read characters directly. This can be seen in the tgetpass.c file in the sudo source.
There are a few other scenarios:
- If an
askpassprogram is specified, e.g. in the-Aparam, that program will be invoked. - Otherwise, if you specifically request
sudoto read fromstdin, e.g. with the-Sflag -- and it will also write the prompt tostderr. This is the case where MadHatter's answer applies. - Otherwise, if there is no
ttyavailable- If password echo is disabled (it is by default, controlled by the
visiblepwflag insudoers),sudowill report an error:no tty present and no askpass program specified - Otherwise,
sudowill fall back to usingstdinandstderreven if it was not specifically requested. MadHatter's answer will also apply here.
- If password echo is disabled (it is by default, controlled by the
The pipe connects sudo cat's stdout to less's stdin, so sudo cat's stdin is unaffected, and able to receive the password.
As for the prompt, it goes out on sudo cat's stderr; in bash, try redirecting that along with stdout, using
sudo cat /etc/resolv.conf |& less and see how different the response is.
- 17While this answer is correct in that
sudo's stdin is still connected to the terminal with the example command, that's not directly relevant to how it gets its password: by defaultsudowill not request passwords via stdin nor will it show the prompt viastderr-- you can try2>/dev/nullto confirm that. Instead,sudodirectly accesses the tty.Bob– Bob2015-10-27 13:01:43 +00:00Commented Oct 27, 2015 at 13:01
While both less and sudo access the terminal directly (by opening /dev/tty, in practice: even if sudo were to have its standard input redirected as well, the password prompt and the reading of its response will occur on the fd obtained by opening /dev/tty), they don't do so at the same time.
Indeed, less will not read from /dev/tty until it is time for it to query you for what to do next: in practice, when the terminal is full or its input has reached end-of-file (which in the case of a pipe occurs when it is orphaned, that is when the fd on the other side is closed for good), whichever comes first. However, sudo will prevent anything from going to standard output until it is done querying you over the terminal, so less can't possibly require your input before that.
But it is true that absolutely nothing enforces exclusion in that regard. For instance, if you were to execute sh -c 'echo "$1"; sudo cat /etc/resolv.conf' sh-c "$MORE_THAN_A_SCREENFUL_OF_HEADER" | less, then you will cause sudo and less to fight over the characters your enter in the terminal; at which point your best option is ctrl-C.
