Create Tmux pane with sudo from sudoed pane?.piWw X ZOo Yyxj cāhr XesY Nnu F
I'm unclear on the terminology here, so please bear with me.
I use Tmux. I sudo foo in my current pane. It prompts for my password; I enter it. Now, for a while, the pane doesn't have to prompt again for my password when I sudo things.
However, if I make a new pane in the current window (e.g. to edit a file while keeping the original pane visible), and I sudo bar, it will prompt for my password again.
Is there a way to pass the "sudo unlocked" state of the first pane to the second one at the moment I create it?
For what it's worth, my shell is Zsh.
To be clear: I'm expecting a Tmux answer here, perhaps a way to change my window-splitting bindings to execute some command upon creating a pane. But I'd also be interested in other ways to configure this behaviour.
1 Answer
On your system, once sudo has authenticated you, the authentication is tied to the particular TTY that you ran sudo from. Each pane in tmux has its own TTY.
sudo on your system uses the tty_ticket option by default, or it uses timestamp_type=tty (possibly not explicitly as it is the default). These settings are documented in the sudoers manual:
tty_ticketsIf set, users must authenticate on a per-tty basis. With this flag enabled,
sudowill use a separate record in the time stamp file for each terminal. If disabled, a single record is used for all login sessions.This option has been superseded by the
timestamp_typeoption.
timestamp_type
sudoersuses per-user time stamp files for credential caching. The timestamp_type option can be used to specify the type of time stamp record used. It has the following possible values:
The values are global, ppid, tty (default), and kernel (see the sudoers manual for a description of each of these).
You may want to modify your sudoers configuration (via the visudo command) to either include
Defaults !tty_tickets
or
Defaults timestamp_type=global
Either of these would tie the authentication to your current login session rather than to a particular TTY.
-
This seems to nail it, thank you. – henrebotha 8 hours ago
man 5 sudoers, search fortty_tickets. It looks like you can configuresudoto keep a single ticket for all your panes and everything else. But you want to escalate the new pane only, right? I expect it's hard to tricksudoit runs under the same controlling terminal as the old pane. Let's suppose you can do this somehow. Thensudowill spawn the actual command with "counterfeit" terminal. But you need the command itself to use the new tty (especially in your example, where you want to edit a file interactively), so you should trick it "back" in a similar way. – Kamil Maciorowski 8 hours ago