Why sudo(1) asks for password when stdout and stderr are redirected?

Question

robot:

#!/bin/bash
sudo echo apple
sudo cat << EOF
banana
EOF

command prompt:

$ sudo true
[sudo] password for vb:
$ ./robot
apple
banana
$ ./robot > /dev/null
$ ./robot &> /dev/null
[sudo] password for vb:

Why sudo(1) asks for password when stdout and stderr are redirected?

Answer 1

It reads from and writes to /dev/tty, which always connects to the current tty/pty.

Answer 2

I understood the question like this:

Why does sudo not remember the password when executed in a script with redirected streams?

Sudo remembers your password (your authentication) for some time so you do not have to enter the password for multiple commands in quick succession.

The duration is controlled by the timestamp_timeout statement in the /etc/sudoers file. Read man sudoers for more information.

More interessting is the question how your authentication is remembered. Everytime you use sudo, sudo will create a file in the directory /var/run/sudo/username (Ubuntu 10.04). The filename is taken from your current terminal (or tty). That means sudo remembers your authentication on a per terminal basis. If you switch to another terminal, sudo will not remember that you just used sudo on the previous terminal.

Example:

$ tty # the tty command prints out the name of the terminal
/dev/pts/1
$ sudo echo foo
[sudo] password for lesmana: 
foo
$ sudo ls -l /var/run/sudo/lesmana
total 0
-rw------- 1 root lesmana  0 2011-04-25 16:56 1

Switch to another terminal.

$ tty
/dev/pts/2
$ sudo echo foo
[sudo] password for lesmana: 
foo
$ sudo ls -l /var/run/sudo/lesmana
total 0
-rw------- 1 root lesmana 0 2011-04-25 16:56 1
-rw------- 1 root lesmana 0 2011-04-25 16:57 2 # <-- new

Switch to a virtual console.

$ tty
/dev/tty/1
$ sudo echo foo
[sudo] password for lesmana: 
foo
$ sudo ls -l /var/run/sudo/lesmana
total 0
-rw------- 1 root lesmana 0 2011-04-25 16:56 1
-rw------- 1 root lesmana 0 2011-04-25 16:57 2
-rw------- 1 root lesmana 0 2011-04-25 16:58 tty1 # <-- new

Now let's examine your case:

I used the same robot script as in the question text.

$ ./robot # <-- no password prompt
apple
banana
$ sudo ls -l /var/run/sudo/lesmana
total 0
-rw------- 1 root lesmana 0 2011-04-25 17:01 1 # <-- timestamp update
-rw------- 1 root lesmana 0 2011-04-25 16:57 2
-rw------- 1 root lesmana 0 2011-04-25 16:58 tty1
$ ./robot > foo
[sudo] password for lesmana: # <-- password prompt
$ sudo ls -l /var/run/sudo/lesmana
total 0
-rw------- 1 root lesmana 0 2011-04-25 17:01 1
-rw------- 1 root lesmana 0 2011-04-25 16:57 2
-rw------- 1 root lesmana 0 2011-04-25 16:58 tty1
-rw------- 1 root lesmana 0 2011-04-25 17:01 unknown # <-- new

See that unknown file. That is why sudo asks you for your password, because you have not previously used sudo on the unknown terminal. For whatever reason sudo is no longer able to determine the terminal when executed in a script with redirected streams.

Note that on my system (ubuntu 10.04), sudo asked for my password when I redirected stdout. I have no idea why on your system sudo only asks the password when redirecting stderr.

Note also that you can make sudo forget your authentication immediately with the command sudo -k. This will only forget the authentication for the terminal where the command was issued.