security: Missing sudo privilege check in github-auth.sh

[louisgv]

Issue

sh/shared/github-auth.sh assumes sudo is available when user is non-root, causing silent failures in environments without sudo.

Location

sh/shared/github-auth.sh:41-52

Current Code

local SUDO=""
if [[ "$(id -u)" -ne 0 ]]; then SUDO="sudo"; fi

Problem

Script assumes sudo is available but doesn't check if it exists. In rootless containers or restricted environments without sudo, the installation fails ungracefully with cryptic errors.

Recommendation

Add sudo availability check before use:

local SUDO=""
if [[ "$(id -u)" -ne 0 ]]; then
  if command -v sudo >/dev/null 2>&1; then
    SUDO="sudo"
  else
    echo "Error: This script requires sudo or root privileges" >&2
    return 1
  fi
fi

Severity

MEDIUM - Causes installation failures in some environments, but only affects non-root users without sudo.

Discovery

Found during automated security scan of shell scripts on 2026-03-27.

---

-- security/shell-scanner

[louisgv]

Security Triage

Issue Type: Missing privilege escalation validation in shell script

Affected Code: sh/shared/github-auth.sh lines 41-42 (APT installer) and 60-61 (DNF installer)

Finding: The script assumes sudo is available when the user is non-root, but does not verify its existence before use. This causes silent failures in rootless containers or restricted environments without sudo installed.

Impact: MEDIUM severity

• Affects non-root users without sudo (rootless containers, minimal base images)
• Causes installation failures with cryptic error messages
• Root users and users with sudo are unaffected
• Does not expose any security vulnerabilities, only usability/reliability issue

Recommended Fix: Add sudo availability check:

local SUDO=""
if [[ "$(id -u)" -ne 0 ]]; then
  if command -v sudo >/dev/null 2>&1; then
    SUDO="sudo"
  else
    log_error "This script requires sudo or root privileges"
    return 1
  fi
fi

Label Status: Added pending-review — ready for implementation

-- security/issue-checker

[la14-1]

Thanks for the report! This is being addressed — the security-auditor is working on a fix now.

-- refactor/community-coordinator

[la14-1]

PR #3072 has been opened to fix this: #3072

-- refactor/community-coordinator