brew breaks sudo password cache

[r-feldbinder]

brew doctor output

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  python-packaging

Verification

• My "brew doctor output" above says Your system is ready to brew. and am still able to reproduce my issue.
• I ran brew update twice and am still able to reproduce my issue.
• This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.

brew config output

HOMEBREW_VERSION: 4.3.12
ORIGIN: https://github.com/Homebrew/brew
HEAD: 874d2da45344d3b27aa740e555b0210d8c474220
Last commit: 8 hours ago
Core tap JSON: 30 Jul 13:41 UTC
Core cask tap JSON: 30 Jul 13:41 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 12
Homebrew Ruby: 3.3.4 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.4/bin/ruby
CPU: dodeca-core 64-bit arm_blizzard_avalanche
Clang: 15.0.0 build 1500
Git: 2.39.3 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.4.0 => /usr/bin/curl
macOS: 14.3.1-arm64
CLT: 15.3.0.0.1.1708646388
Xcode: 15.4
Rosetta 2: false

What were you trying to do (and why)?

I want to type a sudo password only once during a timeout period.

What happened (include all command output)?

After any brew command, any sudo command aftwards requires the password, even when I entered it just before.

What did you expect to happen?

That the sudo password cache does not expire when using brew commands

The following might ask for the sudo password first

sudo -v
brew --help
sudo -v

But since a brew update today it also always asks it after the brew command even though it should be still in the sudo cache

Step-by-step reproduction instructions (by running brew commands)

Just run


sudo -v
brew --help
sudo -v

and see if it asks for the sudo password after the brew command

[carlocab]

This is likely a WONTFIX, sorry. We clear the sudo password cache intentionally as a precaution against privilege escalation attacks. See https://brew.sh/2024/07/30/homebrew-security-audit/.

[BacLuc]

Seems to be hardcoded:

brew/bin/brew

Lines 70 to 74 in eac5720

	if [[ -n "${SUDO}" ]]
	then
	"${SUDO}" --reset-timestamp 2>/dev/null || true
	fi
	unset SUDO

Would you allow a flag which skips resetting the sudo password cache?

Else, I don't see a way to use brew with automation (e.g. Ansible) when it's combined with other package managers (like apt).
One could use Ansible Vault to store the sudo password, and it could be a little more secure if root privileges are only used for the parts where it is needed.
On the other hand, a flag to skip the reset would be very handy.

[MikeMcQuaid]

Would you allow a flag which skips resetting the sudo password cache?

No, seems inappropriate to disable a security feature flagged in our audit this way.

I don't see a way to use brew with automation (e.g. Ansible) when it's combined with other package managers (like apt).

Use SUDO_ASKPASS or sudoers entry. There are many ways of accomplishing this without a flag.