3

When I use e.g. firewall-cmd, which correctly needs root privileges to execute, I get prompted in a window (so not in the terminal as with sudo) to give my password when I try to autocomplete an option (e.g. write "--perm" and hit TAB). This happens every time I use autocompletion, even if I already entered my password before and/or ran a command with sudo (which is configured to not prompt me a second time for a certain time).

Is there any way to either make entering the password permanent for a certain time or complete disable authentication for mere autocompletion (I still want authentication for actually running the program)?

The obvious solution is to login as root (use su or sudo -i), but I'd like to avoid doing that.

I am using bash and my .bashrc sources the standard bash_completion file shipped with the bash-completion package in Debian.

I can reproduce this with just . /etc/bash_completion in my .bashrc.

Running complete -p firewall-cmd results in
bash: complete: firewall-cmd: no completion specification

The reason I thought polkit was involved (see original tags) is, that when I abort the authentication dialogue I get the following on stdout:

Authorization failed.
    Make sure polkit agent is running or run the application as superuser.
  • What shell do you use and how is completion configured? The shell is probably invoking the command to list possible completions, but it's weird that it would run sudo. Do you have an alias or function? – Gilles Nov 6 '16 at 20:54
  • @Gilles I am using bash and my .bashrc sources the standard "bash_completion" file shipped with the bash-completion package in debian (upstream is github.com/scop/bash-completion). I didn't think of that: Does the shell have to invoke the actual command for autocompletion? In that case it is clear why I am asked to authenticate (the executable in question needs root privs), but still not clear why entering the password once is not cached for some time. – imsodin Nov 6 '16 at 21:55
  • The shell doesn't have to invoke the actual command, but it sometimes does. For example it might invoke the command with --help and parse the output to get the exact list of supported options on that particular version of the command. I don't see anything specific to firewall-cmd in the bash_completion code. Can you reproduce this if your .bashrc contains nothing apart from . /etc/bash_completion? If not, post your .bashrc. – Gilles Nov 6 '16 at 22:14
  • @Gilles, icarus: I added this information to the question. Thanks for looking into this! – imsodin Nov 6 '16 at 23:05
3

Normally to see the completion associated with a command like firewall-cmd one would use complete -p firewall-cmd and expect to see something like complete -F _firewall_cmd firewall-cmd coming back. One would then examine the _firewall_cmd function using type _firewall_cmd.

The bash completion package for Debian uses a complete -D command to set up a default completion function, which looks to see if there is a specific completion available the first time it is used, and if so loads it.

Therefore it is important to attempt completion once before looking to see how completion is set up.

For firewall-cmd this file defines the completion function which currently starts

_firewall_cmd()
{
    local cur prev words cword split
    _init_completion -s || return
    firewall-cmd --state 1> /dev/null || return

The /usr/bin/firewall-cmd program itself is a python script, which ends up needing root privileges and asking for authentication. A call of firewall-cmd --state returns true if the firewall is running. The intention of the completion code therefore seems to be to not do completion if the firewall isn't running. However it is written to need the privileges to see if the firewall is running, and this is causing the unwanted prompts.

Deleting the firwall-cmd --state 1> /dev/null || return line from the completion function makes completion faster, not prompt for password, and other general goodness.

-2

You can use nopasswd option of sudo. Just add nopasswd option in suoders file for your user.

e.g. if your user name is imosdin, then modify entry in sudoers by executing command visduo, and add/modify below mentioned entry.

imsodin ALL=(ALL) NOPASSWD: ALL

Now, system will allow imsodin user to execute any command via sudo without prompting for password.

  • I know about that option, but I don't want to give that kind of access. I want authentication including using my password to execute the program, I just don't want to be prompted to give the password whenever I use the autocompletion. – imsodin Nov 6 '16 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.