Why echo 'password' | sudo -S sudo -s does not work whereas echo 'password' | sudo -S mount -a works?

[Ralf Mardorf]

On Mon, 2021-02-08 at 10:31 +0100, Ralf Mardorf via ubuntu-users wrote:
> On Mon, 8 Feb 2021 11:29:14 +0800, 孙世龙 sunshilong wrote:
> > Here are the error messages:
> > vc at localhost:~$ echo 'abc' | sudo -S -s
> > /bin/bash: line 1: abc: command not found
> > vc at localhost:~$ echo 'ccc' | sudo -S -s
> > /bin/bash: line 1: ccc: command not found
> 
> Hi,
> 
> it does work with login shell bash for Arch Linux and login shell bash
> for xenial (at least when running xenial in a systemd-nspawn container).
> 
> 
>   [rocketmouse at archlinux ~]$ echo "abc" | sudo -S -s
>   [sudo] password for rocketmouse: Sorry, try again.
>   [sudo] password for rocketmouse: 
>   sudo: no password was provided
>   sudo: 1 incorrect password attempt
>   [rocketmouse at archlinux ~]$ echo 'abc' | sudo -S -s
>   [sudo] password for rocketmouse: Sorry, try again.
>   [sudo] password for rocketmouse: 
>   sudo: no password was provided
>   sudo: 1 incorrect password attempt
> 
>   [weremouse at moonstudio ~]$ echo "abc" | sudo -S -s
>   [sudo] password for weremouse: Sorry, try again.
>   [sudo] password for weremouse: 
>   sudo: 1 incorrect password attempt
>   [weremouse at moonstudio ~]$ echo 'abc' | sudo -S -s
>   [sudo] password for weremouse: Sorry, try again.
>   [sudo] password for weremouse: 
>   sudo: 1 incorrect password attempt
> 
> 
> Are you using an alias or wrapper script for "sudo"?
> 
> 
>   [weremouse at moonstudio ~]$ man sudo | grep "\-s," -A3
>        -s, --shell
>                    Run the shell specified by the SHELL environment variable if it is set or the shell specified by the invoking user's password database entry.  If a command is specified,
>                    it is passed to the shell for execution via the shell's -c option.  If no command is specified, an interactive shell is executed.
> 
>   [weremouse at moonstudio ~]$ sudo -s lsb_release -a
>   [sudo] password for weremouse: 
>   LSB Version:	core-9.20160110ubuntu0.2-amd64:core-9.20160110ubuntu0.2-noarch:security-9.20160110ubuntu0.2-amd64:security-9.20160110ubuntu0.2-noarch
>   Distributor ID: Ubuntu
>   Description:	  Ubuntu 16.04.7 LTS
>   Release:	  16.04
>   Codename:	  xenial
>   [weremouse at moonstudio ~]$ sudo -s abc
>   /bin/bash: abc: command not found
> 
> 
> Since I'm not using an alias or wrapper scrip it doesn't mention
> "line 1". However, I suspect that due to an alias or wrapper scrip,
> stdin isn't used as the password, since the newline got lost. I
> simulated this by replacing "echo" with "printf".
> 
> 
>   [weremouse at moonstudio ~]$ man sudo | grep "\-S," -A3
>        -S, --stdin
>                    Write the prompt to the standard error and read the password from the standard input instead of using the terminal device.  The password must be followed by a newline
>                    character.
> 
>   [weremouse at moonstudio ~]$ printf "abc" | sudo -S -s
>   /bin/bash: line 1: abc: command not found
> 
> 
> Regards,
> Ralf

PS:

My first assumption doesn't make sens, but here is comes the reason for
the issue. It happens if the password was already provided and not
forgotten.

On Arch Linux:

  [rocketmouse at archlinux ~]$ printf "abc" | sudo -S -s
  [sudo] password for rocketmouse: Sorry, try again.
  [sudo] password for rocketmouse: 
  sudo: no password was provided
  sudo: 1 incorrect password attempt

Again on xenial:

  [weremouse at moonstudio ~]$ printf "abc" | sudo -S -s
  [sudo] password for weremouse: 
  [weremouse at moonstudio ~]$ printf "abc" | sudo -S -s
  [sudo] password for weremouse: 
  [weremouse at moonstudio ~]$ sudo echo "!"
  [sudo] password for weremouse:
  !
  [weremouse at moonstudio ~]$ printf "abc" | sudo -S -s
  /bin/bash: line 1: abc: command not found

Use the k option to solve the issue.

  [weremouse at moonstudio ~]$ printf "abc" | sudo -S -s
  /bin/bash: line 1: abc: command not found
  [weremouse at moonstudio ~]$ printf "abc" | sudo -k -S -s
  [sudo] password for weremouse: