Root privileges obtained within mas wrapper expire immediately

[ilium007]

Configuration

✗ mas config
mas ▁▁▁▁ 4.0.0
arch ▁▁▁ arm64
from ▁▁▁ homebrew/core/mas
origin ▁ https://github.com/mas-cli/mas.git
rev ▁▁▁▁ 21205c013fa941e89463e1d8e553d6e4e3eb8b3f
swift ▁▁ 6.2.1 (swiftlang-6.2.1.4.8 clang-1700.4.4.1)
driver ▁ 1.127.14.1
region ▁ AU
macos ▁▁ 26.1 (25B78)
mac ▁▁▁▁ Mac17,2
cpu ▁▁▁▁ Apple M5

Bug description

When using brew bundle every app needs a password to be entered. This is now unusable for automation unfortunately.

Every app install I see an Error: Failed to install app for ADAM ID xxxx error.

Steps to reproduce

brew bundle

[rgoldberg]

A password being required for each app update is a different issue than the updates failing.

That can be avoided by:

1. you running sudo -k brew bundle instead of brew bundle. This will grant root permissions to all of brew bundle. If you omit the -k, the credentials will last after the call for your terminal until your sudo timeout occurs.
2. you editing the mas wrapper to use sudo instead of sudo -k. This & 3 will grant root permissions after you enter your password until your sudo timeout occurs.
3. me changing the mas wrapper to use sudo instead of sudo -k in the mas distribution. I will consider doing this.
4. you editing your sudoers (or, preferably, a mysudo referenced from your sudoers) to allow mas-bin to be run without requiring a password at all. I do not recommend this unless you understand sudoers & its security ramifications, and that you only grant it for the absolute path to the mas-bin binary while specifying an SHA hash (which must be recalculated for each new mas release), etc. Again, do NOT do this unless you know exactly what you're doing. This will not grant root credentials to anything besides the specific commands for which you've allowed sudo to be used without a password.

I used sudo -k instead of sudo because I was advised to try to limit any granting of root credentials.

You also have 2 different update failures. If we investigate either beyond a cursory level, please open a new issue for each individual problem:

1. Obsidian seems to be an iPadOS app. Is that correct? If so:
   1. mas doesn't yet support iPadOS or iOS apps
   2. How did it get in your Brewfile? mas list, which is used to create Brewfiles, should not have ever included it in its output, IIRC.
2. Keka seems to be a macOS app. I don't know why it didn't initiate any downloads. Can you provide the version of Keka installed on your computer by running mas list 470158793?

[ilium007]

Obsidian is an iPadOS app only (my macOS was installed via brew cask) so disregard.

As for the other apps installing with sudo via brew bundle:

sudo -k brew bundle
Password:
Error: Running Homebrew as root is extremely dangerous and no longer supported.
As Homebrew does not drop privileges on installation you would be giving all
build scripts full access to your system.

I do fully understand the sudoers file and may consider updating my chezmoi config to include a passwordless config for mas. At the moment this is all very 'hacky'.

[rgoldberg]

I am redoing how mas obtains root privileges.

mas will:

1. Use sudo as necessary from the Swift executable; the zsh wrapper will be removed (a wrapper will probably be used in a future mas major version for output tabulation, but not for sudo usage)
2. Only require root privileges if a command will actually result in one or more apps being installed, updated, or uninstalled
3. Use existing root privileges if already granted
4. If root privileges have not already been granted, use sudo -N to either:
   1. If sudo credentials are available, use them. Existing sudo credentials will remain valid pursuant to sudoers settings.
   2. If no sudo credentials are available, request root privileges via the standard sudo password prompt. Newly granted sudo credentials will be valid for only a single mas call.
5. Thus, if mas is called without existing root privileges or sudo credentials once per each of N apps to install/update them, you must enter your password N times. That aligns with the strict security paradigm that was recommended to me.
6. Given that brew bundle rejects being called with root privileges, to avoid entering your password N times to install/update N apps via brew bundle, brew bundle should be updated to pass all the MAS app IDs to mas in one call, instead of making a separate call for each install/update. This obviously depends on the agreement of Homebrew personnel.
7. To facilitate 6, mas will provide upsert-like behavior by either:
   1. Changing the behavior of install
   2. Introducing a new subcommand (maybe named ensure, current, latest, provision, etc.)
   3. Introducing a new flag for install or update

I'm debating which option to choose; I'm leaning towards the second option (a new subcommand), but haven't chosen a subcommand name yet, and haven't yet even definitively decided to implement that option.

Does the above seem satisfactory to you?

[rgoldberg]

@ilium007 Ignore items 4 & later in my prior comment.

I have been given permission for mas to use sudo without any flags to obtain root privileges either by using existing sudo credentials, or by establishing new sudo credentials whose lifetime is determined by the user-configured sudo timeout, which will allow consecutive mas calls from Brew Bundle (or from other scripts or from the command line) to succeed with only one password entry, without requiring any changes to Brew Bundle (or other scripts).

[ilium007]

This would be good if you can get it to work.

[rgoldberg]

I think I have working code. I'm just testing it. Will hopefully release it in 4.1.0 tomorrow or soon thereafter. Will need to finish testing, and will make some other unrelated improvements for 4.1.0.

[ilium007]

Nice! What about Homebrew / brew bundle? Will they need to release an update as well?

[rgoldberg]

Homebrew won't need to change their code.

Homebrew isn't as against establishing sudo credentials that last past command invocations as I had thought.