christianmanivong
7ec427c743
CI / test (3.10) (push) Successful in 23s
CI / test (3.11) (push) Successful in 22s
CI / test (3.12) (push) Successful in 24s
CI / test (3.10) (pull_request) Successful in 23s
CI / test (3.11) (pull_request) Successful in 25s
CI / test (3.12) (pull_request) Successful in 24s
A driver gains root with sudo -S and puts the password in front of stdin. A sudo that does not prompt -- NOPASSWD, a cached timestamp -- leaves it there, and the cat under sudo wrote it into the drop-in as its first line. Seen on the first real run (NetOrk/netork#1027): sshd -t rejected the file and the rollback removed it, but the password was in a 0644 file for a moment and in the error the caller showed. The content now goes without privilege to a mktemp file only the login user can read; root installs that file (mode 644, root-owned) and removes it. The fake host in the tests prepends the password to every privileged stdin, as a non-prompting sudo does. Bumps to 4.5.1. NetOrk/netork#1027, NetOrk/netork#1029