edneville/please

please, a sudo clone

please's Issues

Add (a potentially much better) timestamp_timeout: with a shorter PIN

sudo has this timestamp_timeout option that doesn't re-prompt you for a password within, say, 5 minutes of entering a password

It seems that please doesn't have this option yet, but also I'd like to propose another modification that could make this option even better — slightly less convenient, but more secure — by using the concept of PINs, so instead of not re-prompting you for the full password during this timestamp_timeout period, the please command should instead prompt you every time, but not for your full password, but for a secondary, shorter password (aka "PIN")
This way you don't have to risk some wrong copy&paste or something worse doing anything as root within the blessed period

I understand that with proper more granular permissions this might not be as important, but at the same time not everyone will bother with granularity #1, so this is still useful and and improvement over the total passwordlessness!

[request] please add a general 'as root' example

Hi,
I get that the main USP here is the fine grained control.

Can we have a more broad example on how to replace sudo/doas?

I'm not a sysadmin, I just want to use the hottest new sudo replacement to run commands as root!

Checking the config file for validity should not require setuid

If the file is readable by our user, we should be able to run please --check /etc/please.ini, without needing to have please setuid at that point.

This is especially useful in NixOS, in order to allow us to validate the please.ini file at build time, instead of the user finding out they broke something on accident at run time.

Could not convert keep to numeical file mode

I manually bootstrapped your commit to void-packages and it compiled and installed successfuly.

INFO:

User: dave
Hostname: void

/etc/please.ini:

[dave_root_require_pass]
name = dave
target = root
hostname = void
regex = .*

[dave_edit]
name = dave
require_pass = true
type = edit
editmode = keep
regex = ^.*$

[dave_root_no_pass_reboot]
name = dave
require_pass = false
hostname = void
regex = /sbin/reboot

/etc/pam.d/please:

#%PAM-1.0
auth   include  system-auth
account  include  system-auth
session  include  system-auth

/etc/pam.d/pleaseedit:

#%PAM-1.0
auth   include  system-auth
account  include  system-auth
session  include  system-auth

Output:

$ ~ pleaseedit /etc/please.ini
Could not convert keep to numerical file mode
Exiting due to error, cannot fully process /etc/please.ini