Fix problem with root daemon not starting when sudo timeout is zero.

CHANGELOG.yml

@@ -53,6 +53,14 @@ items:
           All OSS telepresence images are now published at the public registry ghcr.io/telepresenceio
           and all references from the client and traffic-manager has been updated to use this registry
           instead of the one at docker.io/datawire.
+      - type: bugfix
+        title: Root daemon wouldn't start when sudo timeout was zero.
+        body: >-
+          The root daemon refused to start when <code>sudo</code> was configured with a <code>timestamp_timeout=0</code>.
+          This was due to logic that first requested root privileges using a sudo call, and then relied on that these
+          privileges were cached, so that a subsequent call using <code>--non-interactive</code> was guaranteed to succeed.
+          This logic will now instead do one single sudo call, and rely solely on sudo to print an informative prompt and
+          start the daemon in the background.
       - type: bugfix
         title: Detect minikube network when connecting with --docker
         body: >-

integration_test/itest/rm_as_root_unix.go

@@ -7,14 +7,8 @@ package itest
 import (
 	"context"
 	"os/exec"
-
-	"github.com/telepresenceio/telepresence/v2/pkg/proc"
 )
 
 func rmAsRoot(ctx context.Context, file string) error {
-	// We just wanna make sure that the credentials are cached in a uniform way.
-	if err := proc.CacheAdmin(ctx, ""); err != nil {
-		return err
-	}
-	return exec.Command("sudo", "rm", "-f", file).Run()
+	return exec.Command("sudo", "-n", "rm", "-f", file).Run()
 }

pkg/proc/exec.go

@@ -115,13 +115,3 @@ func IsAdmin() bool {
 func Terminate(p *os.Process) error {
 	return terminate(p)
 }
-
-// CacheAdmin will ensure that the current process is able to invoke subprocesses with admin rights
-// without having to ask for the password again. This is needed among other things to make sure the
-// integration tests can see that a password is being asked for.
-func CacheAdmin(ctx context.Context, prompt string) error {
-	// These logs will get picked up by the test-reporter to make sure the user is asked for the password.
-	dlog.Info(ctx, "Asking for admin credentials")
-	defer dlog.Info(ctx, "Admin credentials acquired")
-	return cacheAdmin(ctx, prompt)
-}

pkg/proc/exec_unix.go

@@ -43,48 +43,17 @@ func startInBackground(includeEnv bool, args ...string) error {
 	return nil
 }
 
-func cacheAdmin(ctx context.Context, prompt string) error {
-	// If we're going to be prompting for the `sudo` password, we want to first provide
-	// the user with some info about exactly what we're prompting for.  We don't want to
-	// use `sudo`'s `--prompt` flag for this because (1) we don't want it to be
-	// re-displayed if they typo their password, and (2) it might be ignored anyway
-	// depending on `passprompt_override` in `/etc/sudoers`.  So we'll do a pre-flight
-	// `sudo --non-interactive true` to decide whether to display it.
-	//
-	// Note: Using `sudo --non-interactive --validate` does not work well in situations
-	// where the user has configured `myuser ALL=(ALL:ALL) NOPASSWD: ALL` in the sudoers
-	// file. Hence the use of `sudo --non-interactive true`. A plausible cause can be
-	// found in the first comment here:
-	// https://unix.stackexchange.com/questions/50584/why-sudo-timestamp-is-not-updated-when-nopasswd-is-set
-	needPwCmd := dexec.CommandContext(ctx, "sudo", "--non-interactive", "true")
-	needPwCmd.DisableLogging = true
-	if err := needPwCmd.Run(); err != nil {
-		if prompt != "" {
-			fmt.Println(prompt)
-		}
-		pwCmd := dexec.CommandContext(ctx, "sudo", "true")
-		pwCmd.DisableLogging = true
-		if err := pwCmd.Run(); err != nil {
-			return err
-		}
+func startInBackgroundAsRoot(_ context.Context, args ...string) error {
+	if isAdmin() {
+		return startInBackground(false, args...)
 	}
-	return nil
-}
-
-func startInBackgroundAsRoot(ctx context.Context, args ...string) error {
-	if !isAdmin() {
-		// `sudo` won't be able to read the password from the terminal when we run
-		// it with Setpgid=true, so do a pre-flight `sudo true` (i.e. cacheAdmin) to read the
-		// password, and then enforce that being re-used by passing
-		// `--non-interactive`.
-		prompt := fmt.Sprintf("Need root privileges to run: %s", shellquote.ShellString(args[0], args[1:]))
-		if err := CacheAdmin(ctx, prompt); err != nil {
-			return err
-		}
-		args = append([]string{"sudo", "--non-interactive"}, args...)
-	}
-
-	return startInBackground(false, args...)
+	// Run sudo with a prompt explaining why root credentials are needed.
+	return exec.Command("sudo", append([]string{
+		"-b", "-p",
+		fmt.Sprintf(
+			"Need root privileges to run: %s\nPassword:",
+			shellquote.ShellString(args[0], args[1:])),
+	}, args...)...).Run()
 }
 
 func terminate(p *os.Process) error {

pkg/proc/exec_windows.go

@@ -30,11 +30,6 @@ func createNewProcessGroup(cmd *exec.Cmd) {
 	cmd.SysProcAttr = &windows.SysProcAttr{CreationFlags: windows.CREATE_NEW_PROCESS_GROUP}
 }
 
-func cacheAdmin(_ context.Context, _ string) error {
-	// No-op on windows, there's no sudo caching. Runas will just pop a window open.
-	return nil
-}
-
 func startInBackground(_ bool, args ...string) error {
 	return shellExec("open", args[0], args[1:]...)
 }

pkg/vif/router_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/datawire/dlib/dgroup"
 	"github.com/datawire/dlib/dlog"
 	"github.com/telepresenceio/telepresence/v2/pkg/dos"
-	"github.com/telepresenceio/telepresence/v2/pkg/proc"
 	"github.com/telepresenceio/telepresence/v2/pkg/routing"
 	"github.com/telepresenceio/telepresence/v2/pkg/subnet"
 )
@@ -54,10 +53,6 @@ func (s *RoutingSuite) SetupSuite() {
 	} else {
 		err := dexec.CommandContext(context.Background(), "go", "build", "-o", "testdata/router/router", "testdata/router/main.go").Run()
 		s.Require().NoError(err)
-
-		// Run sudo to get a password prompt out of the way
-		err = proc.CacheAdmin(context.Background(), "")
-		s.Require().NoError(err)
 	}
 	// Make sure there's no existing route
 	cidr := getCidr(2, 1, 32)