Let the password prompt say why

panama-sudo is pkexec with a stated reason: the reason travels to the shell over the existing polkit IPC target, and the prompt renders it labeled "Stated reason (unverified)" beside polkitd's real action message -- beside, never instead of, because any process can claim any reason and the action text is the trust anchor. Reasons are single-shot and expire in ten seconds, so a stale one cannot dress up an unrelated prompt; without a reason, a running shell, or qs the wrapper is exactly pkexec. Built for agents, so the person typing their password learns what for. Verified live end to end -- reason shown, consumed once, expired when stale, cleared on dismissal -- and pinned by the polkit reason contract.
2026-08-21 18:57:26 -04:00
parent 51ceb19480
commit f42b3cfe0e
6 changed files with 221 additions and 2 deletions
@@ -424,8 +424,15 @@ ShellRoot {
        target: "polkit"
        function begin(path: string): void { Polkit.begin(path); }
        function cancel(): void { Polkit.cancel(); }
+        // panama-sudo's side channel: the reason a privileged command is about
+        // to run, shown labeled on the prompt beside polkitd's own message.
+        function reason(text: string): void { Polkit.stateReason(text); }
        function status(): string {
-            return JSON.stringify({ active: Polkit.active, action: Polkit.actionId });
+            return JSON.stringify({
+                active: Polkit.active,
+                action: Polkit.actionId,
+                statedReason: Polkit.statedReason
+            });
        }
    }