Repository navigation
Cork should use macOS-native PAM authorization instead of ingesting an admin password #593
Description
Note: I initially posted this as a security issue on Homebrew's GitHub, but apparently I misremembered, and the Homebrew CLI actually does properly support Touch ID, so this seems to be specific to Cork and not Homebrew.
Hopefully I haven't misremembered again; I could swear I got hit with a bunch of password prompts when I was adopting apps into Homebrew using Cork...
Currently Cork seemingly passes sudo password prompts through to the user by directly ingesting an admin password as a string.
EDIT: Yep! I just got hit with this prompt!
This behavior is particularly noticeable if the user has enabled PAM support for Touch ID, as Cork does not provide passthrough Touch ID support via PAM.
I have observed this same behavior in other places, where it is generally identified as a known security issue.
In the comments on basically this same issue for Balena Etcher I noted that Raspberry Pi Imager does in fact implement this correctly, providing a representative sample of how to call PAM authorization from non-native code, albeit in Objective-C++ rather than Swift (or TypeScript). [Direct link to Raspberry Pi Imager code]
Off the top of my head I don't know if Raspberry Pi Imager is license-compatible with Cork, but the useful thing with the code sample is just that it shows what precisely is involved in requesting sudo access from Apple's system APIs rather than simply ingesting the administrator password as a string.
I am not a Swift developer, but I imagine that since you are already using Apple's system APIs it should be relatively simple to add similar functionality to Cork.
Activity
buresdv commentedon Jan 28, 2026
The problem with PAM is that this is blocked by Homebrew itself. When you spawn a Homerbew process through Swift's
Process, it can only be a non-root process, because Homebrew does not execute root processes and errors out.It has a weird implementation where it requires the admin password to be passed through the
SUDO_ASKPASSvariable.I already tried it before using PAM and couldn't do it, which is why this custom implementation is needed. There's no way to escalate privileges through PAM and then pass the password to the
SUDO_ASKPASSvariable, as far as I was able to find.If the Homebrew developers wanted to talk to me on this, I'd be open to resolving this issue on their end, but they do not want to cooperate, so I had to resort to this solution.
elsiehupp commentedon Jan 30, 2026
Is this perhaps an instance where
pinentry-maccould be used? If so, that might just be the simplest solution here...Forge-Falcon commentedon Mar 28, 2026
The way around this would be to install a launch deamon for executing brew commands, and have corkbrew communicate with that. No one else is doing this right now, so would really elevate your product.
Unprivlaged user with cork brew > Launch Deamon (root) *[1] > Service Account (non-root) *[2] > Brew.
sudo -H -iu homebrew_svc_account brew ...echo "homebrew_svc_account ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/homebrewburesdv commentedon Jul 15, 2026
I keep thinking about this and I believe it would require a custom rewrite of the whole package installation process. Step in if it doesn't make sense.
The problem is much more complex than it might seem at first:
root-owned Homebrew process, because that is blocked by Homebrew itselfSo the only option that remains is to rewrite the whole process and handle the privileged actions in that process.
I think this would be a long-term task better suited for https://github.com/buresdv/Spirytus