Seth/mac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: unattended sudo via temporary NOPASSWD drop-in with triple cleanup

Browse Source 
Piping a password into ssh -tt's pty raced and hung on the real run (worked in
a fast test, blocked for 14 min in practice). Replace with a temp
/etc/sudoers.d/mac-setup installed by _install_sudoers.sh (validated
before activation), removed on every exit path plus a 40-min on-Mac
self-destruct. setup.sh now fails fast if passwordless sudo is absent
instead of depending on a primed tty ticket.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Mortdecai
2026-09-15 19:32:24 -04:00
parent 507bec3f46
commit 39f61f48ce
3 changed files with 38 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/run.sh
+23 -8
View File
@@ -1,16 +1,31 @@
#!/bin/bash
# From steel141: sync repo to the Mac, run setup there, pull backups back, then do the tank side.
# From steel141: sync repo to the Mac, run setup there UNATTENDED, pull backups back, then tank side.
# Usage: scripts/run.sh [--no-tank]
# sudo on the Mac is primed from $HOMELAB_PASSWORD over a forced pty (ssh -tt) so this works from a
# non-interactive session; with the var unset it falls back to an interactive prompt.
#
# Homebrew's install needs sudo for 10+ min across child processes. We grant a TEMPORARY
# /etc/sudoers.d/mac-setup (NOPASSWD) for the run and guarantee its removal three ways:
# 1. explicit removal after setup, 2. an EXIT trap (covers failures / a dropped ssh from here),
# 3. a 40-min self-destruct on the Mac itself (covers steel141 losing the network).
# $HOMELAB_PASSWORD is used once (piped, never in argv) to install the drop-in.
set -euo pipefail
cd "$(dirname "$0")/.."
[[ -n ${HOMELAB_PASSWORD:-} ]] || { echo "HOMELAB_PASSWORD must be set"; exit 1; }
rsync -a --delete --exclude .git --exclude .backup --exclude Brewfile.lock.json ./ mac:mac/
if [[ -n ${HOMELAB_PASSWORD:-} ]]; then
printf '%s\n' "$HOMELAB_PASSWORD" | ssh -tt mac 'sudo -S -v && HOSTNAME_WANT=mac ~/mac/scripts/setup.sh; exit' | tr -d '\r'
else
ssh -t mac 'HOSTNAME_WANT=mac ~/mac/scripts/setup.sh'
fi
cleanup(){ printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac "sudo -S -p '' rm -f /etc/sudoers.d/mac-setup 2>/dev/null; sudo -K 2>/dev/null" || true; }
trap cleanup EXIT
# Install temp NOPASSWD drop-in (installer is a repo file, rsynced above; password piped to its stdin).
printf '%s\n' "$HOMELAB_PASSWORD" | ssh -o BatchMode=yes mac 'bash ~/mac/scripts/_install_sudoers.sh'
# sudo is now passwordless on the Mac; run setup unattended (Homebrew + everything).
ssh -o BatchMode=yes mac "HOSTNAME_WANT=mac ~/mac/scripts/setup.sh"
# Explicit removal + confirm; then disarm the trap so it doesn't double-run.
cleanup; trap - EXIT
ssh -o BatchMode=yes mac 'test ! -e /etc/sudoers.d/mac-setup && echo "[ok] temp sudoers removed" || echo "[WARN] temp sudoers STILL PRESENT"'
mkdir -p .backup/mac && rsync -a mac:.mac-setup-backup/ .backup/mac/
[[ ${1:-} == --no-tank ]] && exit 0
PUB=$(ssh mac cat .ssh/id_ed25519.pub)