From feb04f77fea2e6af189a064c1cea3fe09eb256ec Mon Sep 17 00:00:00 2001
From: Brian Harring <ferringb@chromium.org>
Date: Fri, 3 Feb 2012 21:22:50 -0800
Subject: [PATCH] Require sudo usage to be non-interactive.

First, add a enable_strict_sudo helpers that scripts that are
sudo strict can invoke.  This does a sanity check bailing immediately
if invoked from a non sudo-keep-alive context.

Second, update enter_chroot.sh and make_chroot.sh to be strict.

While this is strict, that's the point.  The aim of this is to block
the previous sudo interactive mess for spreading, let alone reappearing
in scripts/code that has been cleansed.

BUG=chromium-os:18393
TEST=cros_sdk --replace; in the midst of it, do sudo -k.
     cros_sdk should thus bail out w/ an appropriate error.
CQ-DEPEND=I01bb1466cf027401fa387af7fad15e42fd33aea4

Change-Id: I76c5b87a812cc78c30a2eb1a0c56b9e438f4a98f
Reviewed-on: https://gerrit.chromium.org/gerrit/15294
Commit-Ready: Brian Harring <ferringb@chromium.org>
Reviewed-by: Brian Harring <ferringb@chromium.org>
Tested-by: Brian Harring <ferringb@chromium.org>
---
 common.sh               | 11 +++++++++++
 sdk_lib/enter_chroot.sh |  2 ++
 sdk_lib/make_chroot.sh  |  2 ++
 3 files changed, 15 insertions(+)

diff --git a/common.sh b/common.sh
index 340eddf694..58187de883 100644
--- a/common.sh
+++ b/common.sh
@@ -765,3 +765,14 @@ function emerge_custom_kernel() {
   sudo -E PKGDIR="${tmp_pkgdir}" $EMERGE_BOARD_CMD --usepkgonly \
     --root=${install_root} ${kernel} || die "Cannot emerge kernel to root"
 }
+
+function enable_strict_sudo {
+  if [ -z "$CROS_SUDO_KEEP_ALIVE" ]; then
+    echo "$0 was somehow invoked in a way that the sudo keep alive could"
+    echo "not be found.  Failing due to this.  See crosbug.com/18393."
+    exit 126
+  fi
+  function sudo {
+    `type -P sudo` -n "$@"
+  }
+}
diff --git a/sdk_lib/enter_chroot.sh b/sdk_lib/enter_chroot.sh
index 0339a761fe..de484afe48 100755
--- a/sdk_lib/enter_chroot.sh
+++ b/sdk_lib/enter_chroot.sh
@@ -9,6 +9,8 @@
 SCRIPT_ROOT=$(readlink -f $(dirname "$0")/..)
 . "${SCRIPT_ROOT}/common.sh" || exit 1
 
+enable_strict_sudo
+
 # Script must be run outside the chroot and as a regular user.
 assert_outside_chroot
 assert_not_root_user
diff --git a/sdk_lib/make_chroot.sh b/sdk_lib/make_chroot.sh
index 5479a0fc33..56f37e5cc8 100755
--- a/sdk_lib/make_chroot.sh
+++ b/sdk_lib/make_chroot.sh
@@ -14,6 +14,8 @@ SCRIPT_ROOT=$(readlink -f $(dirname "$0")/..)
 
 ENTER_CHROOT=$(readlink -f $(dirname "$0")/enter_chroot.sh)
 
+enable_strict_sudo
+
 # Check if the host machine architecture is supported.
 ARCHITECTURE="$(uname -m)"
 if [[ "$ARCHITECTURE" != "x86_64" ]]; then