Call sudo with --non-interactive

This option prevents any kind of prompts and causes sudo to exit with an error. Use it as safeguard against misconfigured setups which ask for a password.
fausecteam · Sep 15, 2023 · d59ba3a · d59ba3a
1 parent 834fc0d
commit d59ba3a
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 6 deletions.
diff --git a/src/ctf_gameserver/checker/supervisor.py b/src/ctf_gameserver/checker/supervisor.py
@@ -223,7 +223,7 @@ def dup_ctrl_fds():
 
     if sudo_user is not None:
         args = ['sudo', '--user='+sudo_user, '--preserve-env=PATH,CTF_CHECKERSCRIPT,CHECKERSCRIPT_PIDFILE',
-                '--close-from=5', '--'] + args
+                '--close-from=5', '--non-interactive', '--'] + args
 
     env = {**os.environ, 'CTF_CHECKERSCRIPT': '1'}
     script_logger.info('[RUNNER] Executing Checker Script')
@@ -252,7 +252,7 @@ def sigterm_handler(_, __):
         # Avoid using kill(1) because of https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1005376
         kill_args = ['python3', '-c', f'import os; import signal; os.kill({pgid}, signal.SIGKILL)']
         if sudo_user is not None:
-            kill_args = ['sudo', '--user='+sudo_user, '--'] + kill_args
+            kill_args = ['sudo', '--user='+sudo_user, '--non-interactive', '--'] + kill_args
         subprocess.check_call(kill_args)
         # Best-effort attempt to join zombies, primarily for CI runs without an init process
         # Use a timeout to guarantee the Runner itself will always exit within a reasonable time frame

diff --git a/src/ctf_gameserver/vpnstatus/status.py b/src/ctf_gameserver/vpnstatus/status.py
@@ -235,7 +235,7 @@ async def check_wireguard(if_pattern, teams):
     teams_map = {if_pattern % team[1]: team[0] for team in teams}
     results = {}
 
-    cmd = ['sudo', '/usr/bin/wg', 'show', 'all', 'latest-handshakes']
+    cmd = ['sudo', '--non-interactive', '--', '/usr/bin/wg', 'show', 'all', 'latest-handshakes']
     proc = await asyncio.create_subprocess_exec(*cmd, stdout=asyncio.subprocess.PIPE, stderr=None)
 
     while data := await proc.stdout.readline():

diff --git a/tests/checker/test_integration.py b/tests/checker/test_integration.py
@@ -565,8 +565,8 @@ def test_sudo_unfinished(self, monotonic_mock, warning_mock):
         checkerscript_pid = int(checkerscript_pidfile.read())
 
         def signal_script():
-            subprocess.check_call(['sudo', '--user=ctf-checkerrunner', '--', 'kill', '-0',
-                                   str(checkerscript_pid)])
+            subprocess.check_call(['sudo', '--user=ctf-checkerrunner', '--non-interactive', '--',
+                                   'kill', '-0', str(checkerscript_pid)])
 
         # Ensure process is running by sending signal 0
         signal_script()

diff --git a/tests/vpnstatus/test_status.py b/tests/vpnstatus/test_status.py
@@ -24,7 +24,7 @@ def test_wireguard(self):
                 os.fchmod(sudo_file.fileno(), 0o755)
                 script_lines = [
                     '#!/bin/sh',
-                    'if [ "$*" != "/usr/bin/wg show all latest-handshakes" ]; then',
+                    'if [ "$*" != "--non-interactive -- /usr/bin/wg show all latest-handshakes" ]; then',
                     '    exit 1',
                     'fi',
                     'echo "wg_102\tZeymPBFvUbfWHyZSccoWaf5CKEO96YZkCH5lbv8rqU0=\t1689415702"',