fix: refuse stdin to a privileged command while a sudo password is set #24

2026-10-12T18:42:41Z

christianmanivong commented

2026-10-12 18:42:41 +00:00

run_command(privileged=True, stdin=data) sent sudo -S with stdin = <sudo password>\n + data. A sudo that does not prompt (NOPASSWD, a cached timestamp) leaves the password line on stdin. The command then reads it as the first line of the data, and cat > file writes it into the file. This happened on 2026-10-11 with the SSH fix (NetOrk/netork#1027) and is tracked in NetOrk/netork#1029.

Change

run_command raises ValueError for privileged + stdin while a sudo password is set, before any channel opens.
Stdin still reaches the command under sudo -n (no password), for a root login, and for unprivileged commands.
open_stream documents the same caveat.

Callers checked: no caller in netOrk or the other drivers combines privileged + stdin after NetOrk/netork#1029. That PR converts write_compose_file to staging. napalm-device-types' SSH fix already stages. napalm-bsd has its own run_command and the same bug: NAPALM/napalm-bsd#8.

Tests: test_stdin_follows_the_sudo_password, which pinned the old behaviour, is replaced by four tests: refused with a password, allowed without one, allowed as root, unprivileged stdin allowed. Full suite: 141 passed.

After merge: re-pin vendor-drivers.txt in netOrk to the merge commit (in the NetOrk/netork#1029 PR).

`run_command(privileged=True, stdin=data)` sent `sudo -S` with stdin = `<sudo password>\n` + data. A sudo that does not prompt (NOPASSWD, a cached timestamp) leaves the password line on stdin. The command then reads it as the first line of the data, and `cat > file` writes it into the file. This happened on 2026-10-11 with the SSH fix (NetOrk/netork#1027) and is tracked in NetOrk/netork#1029. **Change** - `run_command` raises `ValueError` for privileged + stdin while a sudo password is set, before any channel opens. - Stdin still reaches the command under `sudo -n` (no password), for a root login, and for unprivileged commands. - `open_stream` documents the same caveat. **Callers checked:** no caller in netOrk or the other drivers combines privileged + stdin after NetOrk/netork#1029. That PR converts `write_compose_file` to staging. napalm-device-types' SSH fix already stages. napalm-bsd has its own `run_command` and the same bug: NAPALM/napalm-bsd#8. **Tests:** `test_stdin_follows_the_sudo_password`, which pinned the old behaviour, is replaced by four tests: refused with a password, allowed without one, allowed as root, unprivileged stdin allowed. Full suite: 141 passed. After merge: re-pin `vendor-drivers.txt` in netOrk to the merge commit (in the NetOrk/netork#1029 PR).

christianmanivong added 1 commit 2026-10-12 18:42:41 +00:00

fix: refuse stdin to a privileged command while a sudo password is set

CI / test (3.10) (push) Successful in 1m2s

Details

CI / test (3.11) (push) Successful in 47s

Details

CI / test (3.12) (push) Successful in 42s

Details

CI / test (3.10) (pull_request) Successful in 43s

Details

CI / test (3.11) (pull_request) Successful in 46s

Details

CI / test (3.12) (pull_request) Successful in 51s

Details

647e058b8a

run_command(privileged=True, stdin=data) sent `sudo -S` with stdin =
<sudo password>\n + data. A sudo that does not prompt (NOPASSWD, a cached
timestamp) leaves the password line on stdin, and the command reads it as
the first line of the data - `cat > file` wrote it into the file
(NetOrk/netork#1029).

run_command now raises ValueError for that combination before opening a
channel. Stdin still reaches the command under `sudo -n` (no password set),
for a root login, and for unprivileged commands. Callers stage the data
without privilege and have root install the file. open_stream documents the
same caveat.

christianmanivong merged commit 7b37366a44 into master

2026-10-12 20:19:16 +00:00

christianmanivong deleted branch fix/privileged-stdin-1029

2026-10-12 20:19:16 +00:00

christianmanivong referenced this issue from a commit

2026-10-12 20:23:00 +00:00

chore(vendor): pin napalm-linux to 7b37366 (#1029)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-linux#24