opencode-polkit 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] - 2026-11-04
+
+### Added
+
+- `src/shims.ts`: `su` stand-in. `su -c COMMAND [USER]` (also `-cCOMMAND`,
+  `--command COMMAND`, `--command=COMMAND`) becomes
+  `pkexec --keep-cwd --user USER sh -c COMMAND`, because a non-login `su` keeps
+  the working directory and runs its command through a shell. Every other form
+  is refused with status `64` and one line naming the alternative: `su`,
+  `su -`, `su -l` (login shell → `pkexec bash`), `-m`/`-p`/`-w` (pkexec
+  sanitizes the environment), `-s` (name the shell in the command), `-g`/`-G`
+  (pkexec cannot switch groups), `--pty` (no terminal), `-f` and
+  `--session-command`.
+- README scope statement: the plugin covers elevation → polkit only; ssh,
+  gpg/pinentry, keyrings, database clients, `kinit` and disk encryption are
+  explicitly out of scope and need an askpass helper or a PTY.
+
+### Changed
+
+- README authorisation note: a desktop agent may reuse the password it already
+  holds, so a second command can run without a dialog; that cache belongs to
+  the agent and must not be relied on. `su -c … USER` authenticates an
+  administrator rather than `USER`, and runs the command with `sh -c`.
+
 ## [0.3.0] - 2026-11-01
 
 0.3.0 replaces how the plugin decides anything. It used to parse the command

package/README.md

@@ -1,9 +1,23 @@
 # opencode-polkit
 
-Redirects `sudo` and `doas` to `pkexec` inside OpenCode, so authorisation goes
-through the desktop's polkit agent (KDE, GNOME, …) instead of a terminal the
-shell tool does not have. Applies to commands run by the shell tool; `sudo` in
-other terminals is unchanged.
+Redirects `sudo`, `doas` and `su -c` to `pkexec` inside OpenCode, so
+authorisation goes through the desktop's polkit agent (KDE, GNOME, …) instead of
+a terminal the shell tool does not have. Applies to commands run by the shell
+tool; `sudo` in other terminals is unchanged.
+
+## Scope
+
+This plugin covers one category: **elevation → polkit**. It exists because the
+shell tool has no terminal, so any program that reads a password from `/dev/tty`
+fails there. `sudo`, `doas` and `su -c` are that category, and they are routed
+to `pkexec`, which asks the desktop's polkit agent instead.
+
+Password prompts that are not polkit's business are out of scope: `ssh`,
+`ssh-add`, `gpg`/pinentry, keyrings (`secret-tool`, KWallet), database clients
+(`psql`, `mysql -p`, `redis-cli`), `kinit`, and disk encryption (`cryptsetup`,
+`fscrypt`, `gocryptfs`). They read the process's own terminal, so they need an
+askpass helper or a pseudo-terminal, not polkit; mixing them in would make this
+plugin's boundary meaningless.
 
 ## Installation
 
@@ -37,16 +51,20 @@ For a local checkout, run `npm run build` once, then reference the directory:
 | `sudo -n …`            | refused: pkexec has no non-interactive mode |
 | `sudo -i`, `-s`, `-b`  | refused, with the equivalent command        |
 | `sudoedit`, `visudo`   | refused, with the alternative               |
+| `su -c 'id'`           | dialog, then runs as root                   |
+| `su -c 'id' bob`       | as above, as `bob` (administrator password) |
+| `su`, `su -`, `su -l`  | refused: no interactive shell, no terminal  |
+| `su -m`, `-s`, `-g`, `-w`, `--pty` | refused, with the alternative   |
 | `pkexec …`             | passed through                              |
 
 Refused invocations exit with status 64 and one line naming the alternative.
 
 ## How it works
 
-`sudo` and `doas` stand-ins are placed first on `PATH`, so the shell resolves
-those instead of the system binaries, and they forward the command to `pkexec`.
-Command text is never rewritten, so quoting, pipes and subshells need no special
-handling.
+`sudo`, `doas` and `su` stand-ins are placed first on `PATH`, so the shell
+resolves those instead of the system binaries, and they forward the command to
+`pkexec`. Command text is never rewritten, so quoting, pipes and subshells need
+no special handling.
 
 ## Authorisation
 
@@ -54,11 +72,21 @@ handling.
 one; other actions may not, according to policy. The plugin takes no part in
 that decision.
 
+`org.freedesktop.policykit.exec` asks for administrator authentication on every
+call, but the desktop agent may keep the password it just received and answer
+the next challenge itself (KDE's agent does). A second command in the same
+session then runs without a dialog. That cache belongs to the agent: another
+agent, a restarted agent or a dismissed dialog means the next command prompts
+again, so do not rely on it.
+
 ## Limitations
 
 - Absolute paths (`/usr/bin/sudo`) and relative ones (`./sudo`) bypass `PATH`.
 - Commands that reset `PATH` (`env -i`, `PATH=/usr/bin …`) bypass it as well.
 - Programs that invoke `sudo` with a scrubbed environment bypass it.
+- `su -c … USER` authenticates an administrator (polkit), not `USER`, so an
+  account that real `su` would allow can be refused here.
+- `su -c` runs the command with `sh -c`, not with the target user's login shell.
 
 These bypass the redirect, not polkit, which still decides whether the command
 runs.

package/dist/index.js

@@ -5,7 +5,7 @@ import { installPolkitShims, removePolkitShims } from "./shims.js";
  */
 const FALLBACK_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 /**
- * Redirects sudo/doas to pkexec without touching the command text.
+ * Redirects sudo/doas/su -c to pkexec without touching the command text.
  *
  * The shell tool spawns `$SHELL -c 'command'` with the environment built here,
  * so putting the shims first on PATH lets the shell's own name resolution pick

package/dist/shims.d.ts

@@ -8,8 +8,8 @@ export declare const SHIM_USAGE_EXIT = 64;
 /**
  * Writes the shim scripts into a fresh private directory and returns it.
  * The caller prepends this directory to PATH; the shell then resolves
- * `sudo`/`doas` to these files instead of the system ones. The directory is
- * 0700 so no other local user can rewrite the scripts.
+ * `sudo`/`doas`/`su` to these files instead of the system ones. The directory
+ * is 0700 so no other local user can rewrite the scripts.
  */
 export declare function installPolkitShims(): string;
 /** Deletes a directory created by installPolkitShims. */

package/dist/shims.js

@@ -170,6 +170,112 @@ if [ -n "$user" ]; then
 fi
 run_pkexec "$@"
 `;
+/**
+ * The su shim. `su -c` is the only form pkexec can express exactly: a command
+ * run as the target user through a shell, in the current directory. Every
+ * other form asks for a login shell, an environment, a shell binary, a group
+ * or a terminal, none of which pkexec can honour, so it is refused instead.
+ */
+const SU_SHIM = `#!/bin/sh
+# opencode-polkit: su shim. Routes su -c to pkexec so polkit can authorize it.
+# Generated at plugin startup; do not edit.
+
+fail() {
+	printf 'opencode-polkit: %s\\n' "$1" >&2
+	exit ${SHIM_USAGE_EXIT}
+}
+
+command -v pkexec >/dev/null 2>&1 || fail 'pkexec is not installed; install polkit'
+
+user=
+cmd=
+has_cmd=
+while [ $# -gt 0 ]; do
+	case $1 in
+	--)
+		shift
+		break
+		;;
+	-c)
+		[ $# -ge 2 ] || fail 'su -c needs a command: su -c COMMAND [USER]'
+		cmd=$2
+		has_cmd=1
+		shift 2
+		;;
+	-c?*)
+		cmd=\${1#-c}
+		has_cmd=1
+		shift
+		;;
+	--command)
+		[ $# -ge 2 ] || fail 'su --command needs a command: su --command COMMAND [USER]'
+		cmd=$2
+		has_cmd=1
+		shift 2
+		;;
+	--command=*)
+		cmd=\${1#--command=}
+		has_cmd=1
+		shift
+		;;
+	- | -l | --login)
+		fail 'su starts a login shell; run pkexec bash instead.'
+		;;
+	-s | --shell | -s?* | --shell=*)
+		fail 'su -s picks the shell; name the shell in the command: pkexec sh -c ...'
+		;;
+	-m | -p | --preserve-environment)
+		fail 'pkexec deliberately sanitizes the environment; drop -m/-p.'
+		;;
+	-g | -G | --group | --supp-group | -g?* | -G?* | --group=* | --supp-group=*)
+		fail 'su -g/-G switches groups; pkexec can only switch users.'
+		;;
+	-w | --whitelist-environment | -w?* | --whitelist-environment=*)
+		fail 'su -w whitelists environment variables; pkexec sanitizes the environment.'
+		;;
+	-P | --pty)
+		fail 'su --pty asks for a terminal; the shell tool has none.'
+		;;
+	-f | --fast)
+		fail 'su -f is a shell flag; pass it to the shell in the command instead.'
+		;;
+	--session-command | --session-command=*)
+		fail 'su --session-command keeps the session; pkexec always starts a new process.'
+		;;
+	-h | --help | -V | --version)
+		fail "option has no pkexec equivalent: $1"
+		;;
+	-?*)
+		fail "unknown su option: $1"
+		;;
+	*)
+		[ -z "$user" ] || fail 'su passes arguments after the user name to the shell; use su -c COMMAND USER.'
+		user=$1
+		shift
+		;;
+	esac
+done
+
+# Operands after -- are the same user-then-nothing sequence.
+while [ $# -gt 0 ]; do
+	[ -z "$user" ] || fail 'su passes arguments after the user name to the shell; use su -c COMMAND USER.'
+	user=$1
+	shift
+done
+
+[ -n "$user" ] || user=root
+[ -n "$has_cmd" ] || fail 'su without -c opens an interactive shell; run pkexec bash instead.'
+
+# su keeps the working directory unless it is a login shell, and --keep-cwd is
+# how pkexec does the same. pkexec is silent when the dialog is dismissed
+# (status 126), so say what the status means.
+pkexec --keep-cwd --user "$user" sh -c "$cmd"
+status=$?
+if [ $status -eq 126 ]; then
+	printf 'opencode-polkit: %s\\n' 'the polkit authentication dialog was dismissed' >&2
+fi
+exit $status
+`;
 /** sudoedit edits through sudo's own temporary-file flow; polkit has none. */
 const SUDOEDIT_SHIM = `#!/bin/sh
 printf 'opencode-polkit: sudoedit is not supported; write a temp file and run pkexec install or pkexec cp on it.\\n' >&2
@@ -184,14 +290,15 @@ exit ${SHIM_USAGE_EXIT}
 const POLKIT_SHIM_SCRIPTS = {
     sudo: SUDO_SHIM,
     doas: DOAS_SHIM,
+    su: SU_SHIM,
     sudoedit: SUDOEDIT_SHIM,
     visudo: VISUDO_SHIM,
 };
 /**
  * Writes the shim scripts into a fresh private directory and returns it.
  * The caller prepends this directory to PATH; the shell then resolves
- * `sudo`/`doas` to these files instead of the system ones. The directory is
- * 0700 so no other local user can rewrite the scripts.
+ * `sudo`/`doas`/`su` to these files instead of the system ones. The directory
+ * is 0700 so no other local user can rewrite the scripts.
  */
 export function installPolkitShims() {
     const directory = mkdtempSync(join(shimBaseDirectory(), "opencode-polkit-"));

package/dist/shims.js.map

@@ -1 +1 @@
-{"version":3,"file":"shims.js","sourceRoot":"","sources":["../src/shims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG;;;;;;QAMV,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFtB,CAAA;AAED,yDAAyD;AACzD,MAAM,SAAS,GAAG;;;;;;QAMV,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDtB,CAAA;AAED,8EAA8E;AAC9E,MAAM,aAAa,GAAG;;OAEf,eAAe;CACrB,CAAA;AAED,qFAAqF;AACrF,MAAM,WAAW,GAAG;;OAEb,eAAe;CACrB,CAAA;AAED,+EAA+E;AAC/E,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,aAAa;IACvB,MAAM,EAAE,WAAW;CACpB,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAClC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC3B,mEAAmE;QACnE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;IAC3C,OAAO,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACnF,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrD,CAAC"}
+{"version":3,"file":"shims.js","sourceRoot":"","sources":["../src/shims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACnF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAA;AAEjC;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG;;;;;;QAMV,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFtB,CAAA;AAED,yDAAyD;AACzD,MAAM,SAAS,GAAG;;;;;;QAMV,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuDtB,CAAA;AAED;;;;;GAKG;AACH,MAAM,OAAO,GAAG;;;;;;QAMR,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FtB,CAAA;AAED,8EAA8E;AAC9E,MAAM,aAAa,GAAG;;OAEf,eAAe;CACrB,CAAA;AAED,qFAAqF;AACrF,MAAM,WAAW,GAAG;;OAEb,eAAe;CACrB,CAAA;AAED,+EAA+E;AAC/E,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,SAAS;IACf,IAAI,EAAE,SAAS;IACf,EAAE,EAAE,OAAO;IACX,QAAQ,EAAE,aAAa;IACvB,MAAM,EAAE,WAAW;CACpB,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAClC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC3B,mEAAmE;QACnE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA;IAC3C,OAAO,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACnF,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACrD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "opencode-polkit",
-  "version": "0.3.0",
-  "description": "Redirect sudo/doas to pkexec in OpenCode via PATH shims, so the system polkit agent handles authentication",
+  "version": "0.3.1",
+  "description": "Redirect sudo, doas and su to pkexec in OpenCode via PATH shims, so the system polkit agent handles authentication",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -38,7 +38,7 @@
     "@types/node": "^24.0.0",
     "typescript": "^5.5.0"
   },
-  "keywords": ["opencode-plugin", "sudo", "doas", "pkexec", "polkit", "security"],
+  "keywords": ["opencode-plugin", "sudo", "doas", "su", "pkexec", "polkit", "security"],
   "license": "MIT",
   "repository": {
     "type": "git",