Adapt Tramp password prompts for sudo-like methods

* doc/misc/tramp.texi (Password handling): Explain entries for
doas, sudo and sudoedit.

* etc/NEWS (Tramp): Document changed password prompts.

* lisp/net/tramp-sh.el (tramp-methods) <sudo, doas>:
Add `tramp-password-previous-hop'.
(tramp-maybe-open-connection): Modify `previous-hop' if needed.

* lisp/net/tramp-sudoedit.el (tramp-methods) <sudoedit>:
Add `tramp-password-previous-hop'.
(tramp-sudoedit-null-hop): New defconst.
(tramp-sudoedit-send-command): Use it.

* lisp/net/tramp.el (tramp-methods): Adapt docstring.
(tramp-null-hop): New defconst.
(tramp-get-remote-null-device): Use it.

diff --git a/doc/misc/tramp.texi b/doc/misc/tramp.texi
index ec9f07dc9eeaf905862411368007c7315570e5ba..25ff2796bd93e92652c1e357e7514c9283ff2b44 100644 (file)
--- a/doc/misc/tramp.texi
+++ b/doc/misc/tramp.texi
@@ -1986,6 +1986,20 @@ file name syntax, must be appended to the machine and login items:
 machine melancholia#4711 port davs login daniel%BIZARRE password geheim
 @end example
 
+For the methods @option{doas}, @option{sudo} and @option{sudoedit} the
+password of the user requesting the connection is needed, and not the
+password of the target user.  If these connections happen on the local
+host, an entry with the local user and local host is used:
+
+@example
+machine @var{HOST} port sudo login @var{USER} password secret
+@end example
+
+@var{USER} and @var{HOST} are the strings returned by
+@code{(user-login-name)} and @code{(system-name)}.  If one of these
+methods is connected via a multi hop (@pxref{Multi-hops}), the
+credentials of the previous hop are used.
+
 @vindex auth-source-save-behavior
 If no proper entry exists, the password is read
 interactively.  After successful login (verification of the password),

diff --git a/etc/NEWS b/etc/NEWS
index 5c5684e1d1052282e49b70172b868bbe8cfa77ca..dd9e82287136ab9882b99cfef7433e02362740b6 100644 (file)
--- a/etc/NEWS
+++ b/etc/NEWS
@@ -73,7 +73,7 @@ and Broadway.  We do not recommend that you use this configuration,
 unless you are running a window system that's supported by GDK other
 than X.  Running this configuration on X is known to have problems,
 such as undesirable frame positioning and various issues with keyboard
-input of sequences such as "C-;" and "C-S-u".
+input of sequences such as 'C-;' and 'C-S-u'.
 
 ---
 ** The docstrings of preloaded files are not in "etc/DOC" any more.
@@ -523,7 +523,7 @@ This uses the Tai Tham script, whose support has been enhanced.
 ---
 ** 'savehist.el' can now truncate variables that are too long.
 An element of 'savehist-additional-variables' can now be of the form
-(VARIABLE . MAX-ELTS), which means to truncate the VARIABLE's value to
+'(VARIABLE . MAX-ELTS)', which means to truncate the VARIABLE's value to
 at most MAX-ELTS elements (if the value is a list) before saving the
 value.
 
@@ -962,6 +962,13 @@ When set to non-nil, Tramp does not copy files between two remote
 hosts via a local copy in its temporary directory, but let the 'scp'
 command do this job.
 
++++
+*** Proper password prompts for methods "doas", "sudo" and "sudoedit".
+The password prompts for these methods reflect now the credentials of
+the user requesting such a connection, and not of the user who is the
+target.  This has always been needed, just the password prompt and the
+related 'auth-sources' entry were wrong.
+
 ** Browse URL
 
 ---

diff --git a/lisp/net/tramp-sh.el b/lisp/net/tramp-sh.el
index 40ddf106c999a6af2bec7898f47c8e63fb9d9920..3c2846351538555da242c6fa3e4e8a84c7d19402 100644 (file)
--- a/lisp/net/tramp-sh.el
+++ b/lisp/net/tramp-sh.el
@@ -301,7 +301,8 @@ The string is used in `tramp-methods'.")
                 (tramp-remote-shell-login   ("-l"))
                 (tramp-remote-shell-args    ("-c"))
                 (tramp-connection-timeout   10)
-                (tramp-session-timeout      300)))
+                (tramp-session-timeout      300)
+               (tramp-password-previous-hop t)))
  (add-to-list 'tramp-methods
               `("doas"
                 (tramp-login-program        "doas")
@@ -309,7 +310,8 @@ The string is used in `tramp-methods'.")
                 (tramp-remote-shell         ,tramp-default-remote-shell)
                 (tramp-remote-shell-args    ("-c"))
                 (tramp-connection-timeout   10)
-                (tramp-session-timeout      300)))
+                (tramp-session-timeout      300)
+               (tramp-password-previous-hop t)))
  (add-to-list 'tramp-methods
               `("ksu"
                 (tramp-login-program        "ksu")
@@ -5005,8 +5007,7 @@ connection if a previous connection has died for some reason."
                 (tramp-error vec 'file-error "`tramp-encoding-shell' not set"))
              (let* ((current-host tramp-system-name)
                     (target-alist (tramp-compute-multi-hops vec))
-                    ;; Needed for `tramp-get-remote-null-device'.
-                    (previous-hop nil)
+                    (previous-hop tramp-null-hop)
                     ;; We will apply `tramp-ssh-controlmaster-options'
                     ;; only for the first hop.
                     (options (tramp-ssh-controlmaster-options vec))
@@ -5091,9 +5092,14 @@ connection if a previous connection has died for some reason."
                    ;; Set password prompt vector.
                    (tramp-set-connection-property
                     p "password-vector"
-                    (make-tramp-file-name
-                     :method l-method :user l-user :domain l-domain
-                     :host l-host :port l-port))
+                    (if (tramp-get-method-parameter
+                         hop 'tramp-password-previous-hop)
+                        (let ((pv (copy-tramp-file-name previous-hop)))
+                          (setf (tramp-file-name-method pv) l-method)
+                          pv)
+                      (make-tramp-file-name
+                       :method l-method :user l-user :domain l-domain
+                       :host l-host :port l-port)))
 
                    ;; Set session timeout.
                    (when (tramp-get-method-parameter

diff --git a/lisp/net/tramp-sudoedit.el b/lisp/net/tramp-sudoedit.el
index 797804dfd45006edb7c78b41b44b20dea3b12bd9..a35f9391a1d07603a1cdd7af837aa46cefdb90d9 100644 (file)
--- a/lisp/net/tramp-sudoedit.el
+++ b/lisp/net/tramp-sudoedit.el
@@ -45,7 +45,8 @@
  (add-to-list 'tramp-methods
               `(,tramp-sudoedit-method
                 (tramp-sudo-login (("sudo") ("-u" "%u") ("-S") ("-H")
-                                  ("-p" "Password:") ("--")))))
+                                  ("-p" "Password:") ("--")))
+               (tramp-password-previous-hop t)))
 
  (add-to-list 'tramp-default-user-alist '("\\`sudoedit\\'" nil "root"))
 
@@ -168,6 +169,12 @@ arguments to pass to the OPERATION."
  (tramp-register-foreign-file-name-handler
   #'tramp-sudoedit-file-name-p #'tramp-sudoedit-file-name-handler))
 
+;; Needed for `tramp-read-passwd'.
+(defconst tramp-sudoedit-null-hop
+  (make-tramp-file-name
+   :method tramp-sudoedit-method :user (user-login-name) :host tramp-system-name)
+"Connection hop which identifies the virtual hop before the first one.")
+
 \f
 ;; File name primitives.
 
@@ -825,6 +832,7 @@ in case of error, t otherwise."
       (process-put p 'vector vec)
       (process-put p 'adjust-window-size-function #'ignore)
       (set-process-query-on-exit-flag p nil)
+      (tramp-set-connection-property p "password-vector" tramp-sudoedit-null-hop)
       (tramp-process-actions p vec nil tramp-sudoedit-sudo-actions)
       (tramp-message vec 6 "%s\n%s" (process-exit-status p) (buffer-string))
       (prog1

diff --git a/lisp/net/tramp.el b/lisp/net/tramp.el
index 0ffaeb0ce99bde9a809284b017cebc5819190de3..7b558aec112bc1f5a1270ffd373b5cd4d0cf7f2c 100644 (file)
--- a/lisp/net/tramp.el
+++ b/lisp/net/tramp.el
@@ -315,14 +315,20 @@ pair of the form (KEY VALUE).  The following KEYs are defined:
   * `tramp-connection-timeout'
     This is the maximum time to be spent for establishing a connection.
     In general, the global default value shall be used, but for
-    some methods, like \"su\" or \"sudo\", a shorter timeout
-    might be desirable.
+    some methods, like \"doas\", \"su\" or \"sudo\", a shorter
+    timeout might be desirable.
 
   * `tramp-session-timeout'
     How long a Tramp connection keeps open before being disconnected.
-    This is useful for methods like \"su\" or \"sudo\", which
+    This is useful for methods like \"doas\" or \"sudo\", which
     shouldn't run an open connection in the background forever.
 
+  * `tramp-password-previous-hop'
+    The password for this connection is the same like the
+    password for the previous hop.  If there is no previous hop,
+    the password of the local user is applied.  This is needed
+    for methods like \"doas\", \"sudo\" or \"sudoedit\".
+
   * `tramp-case-insensitive'
     Whether the remote file system handles file names case insensitive.
     Only a non-nil value counts, the default value nil means to
@@ -1427,6 +1433,11 @@ calling HANDLER.")
 (put #'tramp-file-name-localname 'tramp-suppress-trace t)
 (put #'tramp-file-name-hop 'tramp-suppress-trace t)
 
+;; Needed for `tramp-read-passwd' and `tramp-get-remote-null-device'.
+(defconst tramp-null-hop
+  (make-tramp-file-name :user (user-login-name) :host tramp-system-name)
+"Connection hop which identifies the virtual hop before the first one.")
+
 (defun tramp-file-name-user-domain (vec)
   "Return user and domain components of VEC."
   (when (or (tramp-file-name-user vec) (tramp-file-name-domain vec))
@@ -5938,8 +5949,8 @@ name of a process or buffer, or nil to default to the current buffer."
 
 (defun tramp-get-remote-null-device (vec)
   "Return null device on the remote host identified by VEC.
-If VEC is nil, return local null device."
-  (if (null vec)
+If VEC is nil or `tramp-null-hop', return local null device."
+  (if (or (null vec) (equal vec tramp-null-hop))
       null-device
     (with-tramp-connection-property vec "null-device"
       (let ((default-directory (tramp-make-tramp-file-name vec)))