Module sudo_askpass 

sudo passwords for the bash tool, through sudo’s own askpass hook (Linux).

The bash tool runs sudo as sudo -A with SUDO_ASKPASS pointing at a private link to this very binary (synaps-sudo-askpass). sudo starts that helper only when it really needs a password, passes its prompt as argv[1] and reads the password from the helper’s stdout. The helper asks the bash tool call that set it up, over a Unix socket in a 0700 per-call directory, and the tool call raises the secret prompt.

Before anything is shown to the user, both ends check who is asking:

• the helper’s parent must be the system sudo: started by this user and running set-uid root (/proc/<pid>/status: real uid ours, effective and saved uid 0, name sudo). /proc/<sudo>/exe is NOT readable to us: sudo is a non-dumpable set-uid process, so the kernel refuses (EACCES, checked against sudo 1.9.17). The credentials in status are kept by the kernel and cannot be forged by a process of the same user; if exe is readable (running as root), it must also be a root-owned set-uid file.
• the broker re-checks everything from the socket’s peer credentials, so a process that skips the helper and talks to the socket gains nothing: peer uid ours, peer runs this binary, peer’s parent is the system sudo, and that sudo descends from the shell this tool call spawned, so a request cannot cross between tool calls or sessions;
• a random token, rotated after every use, must match.

The prompt names the command sudo is about to run (its argv, sanitised and bounded), so the user can judge the request. The password goes only to the helper, which writes it to sudo’s pipe. It never reaches the command’s stdin (which is empty) or the model, and it is redacted from the tool output if the command echoes it.

Limits: a command inside the tool call that runs sudo -A itself still gets a prompt (that is how sudo works), which is why the prompt shows the command. Code running as the same user can ptrace the helper or point its own sudo at its own askpass program; that is the user’s account, not a boundary this can draw. Two sudo password requests racing in one call share one token, so the second is refused.

Functions

run_helper_if_invoked

Call first thing in main. Returns the exit code when this process was started as the askpass helper (argv[0] is the helper link), None otherwise; either way it records that this binary can be the helper.