fix: never let root read the SSH configuration from stdin #30

2026-10-11T21:48:51Z

christianmanivong commented

2026-10-11 21:48:51 +00:00

A non-prompting sudo -S leaves the password on stdin; the privileged cat wrote it into the drop-in (seen on the first real run, NetOrk/netork#1027). Content is now staged without privilege (mktemp, 0600) and installed by root. Tests model a non-prompting sudo. 4.5.1. See also NetOrk/netork#1029.

christianmanivong added 1 commit 2026-10-11 21:48:51 +00:00

fix: never let root read the SSH configuration from stdin

CI / test (3.10) (push) Successful in 23s

Details

CI / test (3.11) (push) Successful in 22s

Details

CI / test (3.12) (push) Successful in 24s

Details

CI / test (3.10) (pull_request) Successful in 23s

Details

CI / test (3.11) (pull_request) Successful in 25s

Details

CI / test (3.12) (pull_request) Successful in 24s

Details

7ec427c743

A driver gains root with sudo -S and puts the password in front of stdin.
A sudo that does not prompt -- NOPASSWD, a cached timestamp -- leaves it
there, and the cat under sudo wrote it into the drop-in as its first line.
Seen on the first real run (NetOrk/netork#1027): sshd -t rejected the file
and the rollback removed it, but the password was in a 0644 file for a
moment and in the error the caller showed.

The content now goes without privilege to a mktemp file only the login user
can read; root installs that file (mode 644, root-owned) and removes it.
The fake host in the tests prepends the password to every privileged stdin,
as a non-prompting sudo does.

Bumps to 4.5.1. NetOrk/netork#1027, NetOrk/netork#1029

christianmanivong merged commit e58b65a3db into main

2026-10-11 21:50:08 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-device-types#30