|
| 1 | +import * as childProcess from "node:child_process"; |
1 | 2 | import { appendFile, rm } from "node:fs/promises"; |
2 | 3 | import { tmpdir } from "node:os"; |
3 | 4 | import path from "node:path"; |
4 | 5 |
|
| 6 | +import * as vscode from "vscode"; |
5 | 7 | import type { CancellationToken, LogOutputChannel } from "vscode"; |
6 | 8 |
|
7 | | -import { spawn, SpawnError } from "./spawn.ts"; |
| 9 | +import { pipeToLogOutputChannel, spawn, SpawnError } from "./spawn.ts"; |
8 | 10 |
|
9 | 11 | export interface SpawnElevatedDarwinOptions { |
10 | 12 | script: string; |
@@ -50,28 +52,136 @@ export interface SpawnElevatedLinuxOptions { |
50 | 52 | cancellationToken?: CancellationToken; |
51 | 53 | } |
52 | 54 |
|
53 | | -export async function spawnElevatedLinux( |
| 55 | +async function tryPkexec( |
54 | 56 | options: SpawnElevatedLinuxOptions, |
55 | | -): Promise<{ cancelled: boolean }> { |
| 57 | +): Promise<{ success: boolean; cancelled: boolean }> { |
| 58 | + const scriptArg = JSON.stringify(options.script); |
56 | 59 | try { |
57 | | - await spawn("pkexec", ["sh", "-c", `${JSON.stringify(options.script)}`], { |
| 60 | + await spawn("pkexec", ["sh", "-c", scriptArg], { |
58 | 61 | outputChannel: options.outputChannel, |
59 | 62 | outputLabel: options.outputLabel, |
60 | 63 | cancellationToken: options.cancellationToken, |
61 | 64 | }); |
62 | | - return { |
63 | | - cancelled: false, |
64 | | - }; |
| 65 | + return { success: true, cancelled: false }; |
65 | 66 | } catch (error) { |
66 | | - if (error instanceof SpawnError && error.code === 126) { |
67 | | - return { cancelled: true }; |
| 67 | + if (error instanceof SpawnError) { |
| 68 | + // User cancelled (pkexec returns 126) |
| 69 | + if (error.code === 126) { |
| 70 | + return { success: true, cancelled: true }; |
| 71 | + } |
| 72 | + // Other failures (no polkit agent, TTY error, etc.) - signal to try fallback |
| 73 | + return { success: false, cancelled: false }; |
68 | 74 | } |
69 | | - |
70 | | - options.outputChannel.error(error instanceof Error ? error : String(error)); |
71 | 75 | throw error; |
72 | 76 | } |
73 | 77 | } |
74 | 78 |
|
| 79 | +async function spawnWithSudoPassword( |
| 80 | + options: SpawnElevatedLinuxOptions, |
| 81 | +): Promise<{ cancelled: boolean }> { |
| 82 | + // Security note: This approach is less secure than pkexec because: |
| 83 | + // - Password flows through VS Code → Node.js → child process stdin (more attack surface) |
| 84 | + // - Password briefly exists in application memory (vulnerable to memory dumps) |
| 85 | + // - Potential attack vector: A malicious VS Code extension could theoretically intercept |
| 86 | + // the password by hooking into Node.js I/O streams or reading process memory |
| 87 | + // (though VS Code's extension sandbox provides some isolation) |
| 88 | + // |
| 89 | + // However, this is acceptable because: |
| 90 | + // - We only use this when pkexec is unavailable (systems without desktop environment) |
| 91 | + // - Password is masked in input, never logged, and passed via stdin only |
| 92 | + // - Password is not stored/cached and is disposed immediately |
| 93 | + // - This is a one-time installation operation, not continuous privileged access |
| 94 | + // |
| 95 | + // Alternative: complete installation failure on systems without polkit agents |
| 96 | + const password = await vscode.window.showInputBox({ |
| 97 | + prompt: "Enter your sudo password", |
| 98 | + password: true, |
| 99 | + ignoreFocusOut: true, |
| 100 | + }); |
| 101 | + |
| 102 | + if (password === undefined) { |
| 103 | + return { cancelled: true }; |
| 104 | + } |
| 105 | + |
| 106 | + const outputLabel = options.outputLabel ? `[${options.outputLabel}]: ` : ""; |
| 107 | + |
| 108 | + return new Promise((resolve, reject) => { |
| 109 | + let stderrOutput = ""; |
| 110 | + |
| 111 | + const child = childProcess.spawn( |
| 112 | + "sudo", |
| 113 | + ["-S", "sh", "-c", options.script], |
| 114 | + { |
| 115 | + stdio: ["pipe", "pipe", "pipe"], |
| 116 | + }, |
| 117 | + ); |
| 118 | + |
| 119 | + // Capture stderr to detect wrong password |
| 120 | + child.stderr?.on("data", (data: Buffer) => { |
| 121 | + stderrOutput += data.toString(); |
| 122 | + }); |
| 123 | + |
| 124 | + // Write password to stdin and close it |
| 125 | + // Note: We use stdin rather than command-line arguments because: |
| 126 | + // - Command-line args are visible in process listings (eg ps aux) |
| 127 | + // - stdin prevents the password from appearing in logs or shell history |
| 128 | + // - stdin data is not visible to other users on the system |
| 129 | + // However, the password still exists briefly in our process memory and the pipe buffer |
| 130 | + child.stdin.write(`${password}\n`); |
| 131 | + child.stdin.end(); |
| 132 | + |
| 133 | + // Redirect the child process stdout/stderr to VSCode's output channel for visibility |
| 134 | + pipeToLogOutputChannel(child, options.outputChannel, outputLabel); |
| 135 | + |
| 136 | + const disposeCancel = options.cancellationToken?.onCancellationRequested( |
| 137 | + () => { |
| 138 | + child.kill("SIGINT"); |
| 139 | + reject(new Error("Command cancelled")); |
| 140 | + }, |
| 141 | + ); |
| 142 | + |
| 143 | + child.on("close", (code) => { |
| 144 | + disposeCancel?.dispose(); |
| 145 | + if (code === 0) { |
| 146 | + resolve({ cancelled: false }); |
| 147 | + } else { |
| 148 | + // Detect wrong password from stderr |
| 149 | + const isWrongPassword = |
| 150 | + stderrOutput.includes("Sorry, try again") || |
| 151 | + stderrOutput.includes("incorrect password") || |
| 152 | + stderrOutput.includes("Authentication failure"); |
| 153 | + |
| 154 | + const errorMessage = isWrongPassword |
| 155 | + ? "Incorrect sudo password" |
| 156 | + : `sudo command failed with exit code ${code}`; |
| 157 | + |
| 158 | + reject(new Error(errorMessage)); |
| 159 | + } |
| 160 | + }); |
| 161 | + |
| 162 | + child.on("error", (error) => { |
| 163 | + disposeCancel?.dispose(); |
| 164 | + reject(error); |
| 165 | + }); |
| 166 | + }); |
| 167 | +} |
| 168 | + |
| 169 | +export async function spawnElevatedLinux( |
| 170 | + options: SpawnElevatedLinuxOptions, |
| 171 | +): Promise<{ cancelled: boolean }> { |
| 172 | + // Try pkexec first (works with graphical polkit agents) |
| 173 | + const pkexecResult = await tryPkexec(options); |
| 174 | + if (pkexecResult.success) { |
| 175 | + return { cancelled: pkexecResult.cancelled }; |
| 176 | + } |
| 177 | + |
| 178 | + // Fallback: prompt for sudo password via VS Code input |
| 179 | + options.outputChannel.info( |
| 180 | + "pkexec not available, falling back to sudo password prompt", |
| 181 | + ); |
| 182 | + return spawnWithSudoPassword(options); |
| 183 | +} |
| 184 | + |
75 | 185 | export async function spawnElevatedWindows({ |
76 | 186 | script, |
77 | 187 | outputChannel, |
|
0 commit comments