fix(acfs): prevent wrapper sudo password prompts

Author: Dicklesworthstone

scripts/acfs-global

@@ -1037,12 +1037,12 @@ main() {
             fi
             found_candidates=1
             echo "  - $candidate_user: $candidate_bin" >&2
-            echo "    Try: sudo -u \"$candidate_user\" -H -- \"$0\" [args...]" >&2
+            echo "    Try: sudo -n -u \"$candidate_user\" -H -- \"$0\" [args...]" >&2
         done < <(getent_passwd_entry 2>/dev/null || true)
 
         echo "" >&2
         echo "If ACFS was installed for a different user, run this wrapper as that user, e.g.:" >&2
-        echo "  sudo -u <user> -H -- \"$0\" [args...]" >&2
+        echo "  sudo -n -u <user> -H -- \"$0\" [args...]" >&2
         echo "" >&2
         echo "You can also override state discovery:" >&2
         echo "  ACFS_STATE_FILE=/path/to/state.json \"$0\" [args...]" >&2
@@ -1102,6 +1102,7 @@ main() {
         local env_bin=""
         local runuser_bin=""
         local sudo_bin=""
+        local true_bin=""
 
         sanitized_state_file="$(sanitize_abs_nonroot_path "${ACFS_STATE_FILE:-}" 2>/dev/null || true)"
         sanitized_system_state_file="$(sanitize_abs_nonroot_path "${ACFS_SYSTEM_STATE_FILE:-}" 2>/dev/null || true)"
@@ -1155,7 +1156,7 @@ main() {
 
             sudo_bin="$(system_binary_path sudo 2>/dev/null || true)"
             if [[ -n "$sudo_bin" ]]; then
-                exec "$sudo_bin" -u "$user" -H "${cmd_with_env[@]}"
+                exec "$sudo_bin" -n -u "$user" -H "${cmd_with_env[@]}"
             fi
 
             echo "Error: need runuser or sudo to run acfs as '$user'" >&2
@@ -1168,8 +1169,16 @@ main() {
             exit 1
         fi
 
+        true_bin="$(system_binary_path true 2>/dev/null || true)"
+        true_bin="${true_bin:-true}"
+        if ! "$sudo_bin" -n -u "$user" -H "$true_bin" 2>/dev/null; then
+            echo "Error: passwordless sudo is required to run acfs as '$user' from this account." >&2
+            echo "Log in as '$user' and rerun acfs, or run it from root/noninteractive sudo." >&2
+            exit 1
+        fi
+
         echo "Note: Running acfs as '$user' (ACFS owner)" >&2
-        exec "$sudo_bin" -u "$user" -H "${cmd_with_env[@]}"
+        exec "$sudo_bin" -n -u "$user" -H "${cmd_with_env[@]}"
     }
 
     # If owner detection failed or we're already the target user, run directly

scripts/acfs-update

@@ -937,6 +937,7 @@ exec_as_target_user() {
   local env_bin=""
   local runuser_bin=""
   local sudo_bin=""
+  local true_bin=""
 
   sanitized_state_file="$(sanitize_abs_nonroot_path "${ACFS_STATE_FILE:-}" 2>/dev/null || true)"
   sanitized_system_state_file="$(sanitize_abs_nonroot_path "${ACFS_SYSTEM_STATE_FILE:-}" 2>/dev/null || true)"
@@ -990,7 +991,7 @@ exec_as_target_user() {
 
     sudo_bin="$(system_binary_path sudo 2>/dev/null || true)"
     if [[ -n "$sudo_bin" ]]; then
-      exec "$sudo_bin" -u "$user" -H "${cmd_with_env[@]}"
+      exec "$sudo_bin" -n -u "$user" -H "${cmd_with_env[@]}"
     fi
 
     echo "Error: need runuser or sudo to run acfs-update as '$user'" >&2
@@ -1003,8 +1004,16 @@ exec_as_target_user() {
     exit 1
   fi
 
+  true_bin="$(system_binary_path true 2>/dev/null || true)"
+  true_bin="${true_bin:-true}"
+  if ! "$sudo_bin" -n -u "$user" -H "$true_bin" 2>/dev/null; then
+    echo "Error: passwordless sudo is required to run acfs-update as '$user' from this account." >&2
+    echo "Log in as '$user' and rerun acfs-update, or run it from root/noninteractive sudo." >&2
+    exit 1
+  fi
+
   echo "Note: Running acfs-update as '$user' (ACFS owner)" >&2
-  exec "$sudo_bin" -u "$user" -H "${cmd_with_env[@]}"
+  exec "$sudo_bin" -n -u "$user" -H "${cmd_with_env[@]}"
 }
 
 main() {

scripts/generated/internal_checksums.sh

@@ -24,8 +24,8 @@ declare -gA ACFS_INTERNAL_CHECKSUMS=(
   [scripts/lib/user.sh]="03fb18f299da1f0e27a87ddd0e0ce47027a6597e11fbf07ee3c8c53edae7d501"
   [scripts/lib/tools.sh]="e2d48e800888b759245e66cc9d86d097d83bf10f6d3bd2fcd17ec4bddfec94e0"
   [scripts/lib/export-config.sh]="6280123436223b5708f506b0a18b83c64891f8ee55af93c5c513f7fb202b97e3"
-  [scripts/acfs-global]="593829bc77d2f2e65f012fa09446937ae4620e0d85e3d5534f499bc7f507b596"
-  [scripts/acfs-update]="3ab9578caa95e7866a706c543bc8af9302ccf20538b716cca621e5c037ee24b0"
+  [scripts/acfs-global]="1b7b9d64efa06fd2a31e373b905223373ae71d7e875a34b5a29d1a5e0001148e"
+  [scripts/acfs-update]="a3001699d8967640291b414c7a29b48cdeecac0549ffa29e6242cb43297f2c0f"
 )
 
 ACFS_INTERNAL_CHECKSUMS_COUNT=18

tests/unit/lib/test_update.bats

@@ -4859,6 +4859,27 @@ EOF
     done
 }
 
+@test "global wrappers use noninteractive sudo for cross-user re-exec" {
+    local update_wrapper="$PROJECT_ROOT/scripts/acfs-update"
+    local global_wrapper="$PROJECT_ROOT/scripts/acfs-global"
+
+    run grep -F 'exec "$sudo_bin" -n -u "$user" -H "${cmd_with_env[@]}"' "$update_wrapper"
+    assert_success
+    run grep -F 'if ! "$sudo_bin" -n -u "$user" -H "$true_bin" 2>/dev/null; then' "$update_wrapper"
+    assert_success
+    run grep -F 'passwordless sudo is required to run acfs-update as' "$update_wrapper"
+    assert_success
+
+    run grep -F 'exec "$sudo_bin" -n -u "$user" -H "${cmd_with_env[@]}"' "$global_wrapper"
+    assert_success
+    run grep -F 'if ! "$sudo_bin" -n -u "$user" -H "$true_bin" 2>/dev/null; then' "$global_wrapper"
+    assert_success
+    run grep -F 'passwordless sudo is required to run acfs as' "$global_wrapper"
+    assert_success
+    run grep -F 'sudo -n -u <user> -H -- \"$0\" [args...]' "$global_wrapper"
+    assert_success
+}
+
 @test "ACFS home resolvers honor explicit TARGET_HOME over stale system state" {
     local current_home
     local target_home