Christian Manivong
cf8ee38a90
CI / test (3.10) (push) Successful in 56s
CI / test (3.11) (push) Successful in 50s
CI / test (3.12) (push) Successful in 44s
CI / test (3.10) (pull_request) Successful in 42s
CI / test (3.11) (pull_request) Successful in 44s
CI / test (3.12) (pull_request) Successful in 53s
_sudo typed `echo '<password>' | sudo -S -p "" <command>` into netmiko's interactive shell. bash kept it in its history, so every poll wrote the sudo password into the login user's ~/.bash_history, and while the command ran it was in the process list for every local user (NetOrk/netork#1039). _sudo, _sudo_status and _run_privileged with a password now run on an exec channel like run_command(privileged=True): the password reaches sudo -S on stdin, there is no PTY to echo it, and the script starts with `exec </dev/null` so a non-prompting sudo leaves it unread. The whole command runs as root in one sh -c - before, only the part up to the first `;`, `&&` or `|` did. The exit status comes from the channel. The interactive session switches its history off before its first command. get_vpn_tunnels with a password reads `wg show all dump` from the exec channel instead of a temp file that held the private keys.