Sudo double confirmation

h3xo · 2022-02-17 22:26:14

Is there a possibility to force sudo to ask for password twice while using some commands? I mostly think about potentially harmful commands like:

rm
dd
mkfs.something
mv
and so on...

Last edited by h3xo (2022-02-17 22:28:40)

qinohe · 2022-02-17 22:59:38

Why ask conformation for something you want to do? You probably do it anyway!
The only difference would be 'sudo' asking you: 'this is dangerous are you sure you want to do this?' and you answer 'yes'.
Where you 'should' answer; 'mind your own business sudo, I decide what's dangerous'.
I understand what your hinting at, but, you should have checked your command before you execute it.
This way you probably hit the 'enter' button with a little more respect than when conformation is asked, my 50cents!

V1del · 2022-02-17 23:33:42

I tend to agree, if the first sudo prompt doesn't give you pause to double check your command, why would the second? You'll eventually just find it annoying. this also sounds like you are too habitually slamming sudo in front of things where it doesn't belong and thus get prompted too often that you somehow want to "safeguard" it against something really dangerous.

Wild Penguin · 2022-02-18 09:44:20

I agree, double confirmations will probably not work. They don't solve the core problem(s)!

Personally, I always pause for a while (5-10 seconds) if/when I'm using dd, or any command I know can be disastrous. I've taken this as a habit early on, and never actually destroyed anything with dd (but, also, see note later about right tools...).

Don't use rm but use mv (just because it is usually much more easy to recover in case you've made an error).

Avoid using wildcards (especially when running as root, but user documents are also important). For example, instead of rm -Rf * do rm -Rf "directory name", preferentially with an absolute path!

Also, choose the right tool for the job; as an example, I've mostly abandoned using dd for usb image writing. A GUI tool has some safeguards, can display information about the target device, and does some sanity checking such as not allowing to write to an internal drive (unless specifically told you want to do so).

But all of the above (in this thread) could be a problem, take them into account, slow down, and...

Take backups!

If you still think you need double confirmations, what you could do is to make an alias to sudo and filter out commands somehow in the alias (script) and ask for prompts. I wouldn't recommend that route, though, as the core reason is something else.

HTH!

As a sidenote: don't use environment variables in commands - or, if you do, better use a script which checks they are what you assume they are. I saw in reddit a user, who was working on a directory as root and had that directory in a variable ... except the one time, when he didn't. You can imagine what a $TARGETDIR/* then becomes!

Last edited by Wild Penguin (2022-02-18 09:47:46)

mpan · 2022-02-18 14:25:35

sudo is not a safety feature. Quite opposite. It was never designed to prevent you from doing something accidently and can’t be expected to give even a single warning, not to mention two. What you see as “confirmation” is happening coincidently because sudo can’t proceed without credentials. Once it has them, it will not ask at all.

Just get the habit of looking at what you invoke before pressing enter. And rely on the commands protecting you. Out of the commands you have mentioned: mkfs.ext* and mkfs.btrfs will whine if you try to overwrite an existing file-system (some others in the family will unfortunately not⁽¹⁾), rm, mv, cp have options to force them to ask for confirmation, using dd instead of e.g. cp is by itself a mistake.⁽²⁾

For rm, mv and cp you may define aliases. While sudo itself will not see the aliases, your shell may expand an alias along other arguments. For example in bash to achieve that you make an alias which has a command trailed with a space. That space at the end tells bash: if the alias is invoked, the first thing following it is itself may be alias to be expanded. So to have a sudo that accepts aliases:

alias sudo='sudo '

____
⁽¹⁾ mkfs.fat being a common exception.
⁽²⁾ Except for very rare situations, which are almost never encountered by most users.

Arch Linux

#1 2022-02-17 22:26:14

Sudo double confirmation

#2 2022-02-17 22:59:38

Re: Sudo double confirmation

#3 2022-02-17 23:33:42

Re: Sudo double confirmation

#4 2022-02-18 09:44:20

Re: Sudo double confirmation

#5 2022-02-18 14:25:35

Re: Sudo double confirmation

Board footer