Unix: add doas elevation support

Prefer sudo when available and fall back to doas on Unix. Run doas authentication through a PTY while keeping service communication on stdin/stdout pipes, and use a no-fork service mode for the doas path.

Keep doas authentication terminal descriptors close-on-exec and close the slave descriptor after attaching it as the controlling terminal. Preserve startup diagnostics through stderr until service synchronization completes, then redirect no-fork service stderr away from the closed parent pipe.

Use noninteractive privilege-helper auth checks for both sudo and doas so cached, nopass, or persisted sessions do not need an unnecessary VeraCrypt password prompt. Keep the PTY password path for doas when authentication is required.

Use a shared Unix DOAS_USER helper for FUSE and mount ownership, backed by getpwnam_r and guarded so non-OpenBSD platforms only trust it for VeraCrypt's internal doas no-fork service path. Detach asynchronous child-reaper threads to avoid leaking joinable pthread handles.

Author: idrassi

src/Core/Unix/CoreService.cpp

@@ -24,7 +24,7 @@ namespace VeraCrypt
 	class CoreService
 	{
 	public:
-		static void ProcessElevatedRequests ();
+		static void ProcessElevatedRequests (bool forkProcess = true);
 		static void ProcessRequests (int inputFD = -1, int outputFD = -1);
 		static void RequestCheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair);
 		static void RequestDismountFilesystem (const DirectoryPath &mountPoint, bool force);
@@ -70,6 +70,7 @@ namespace VeraCrypt
 	};
 
 #define TC_CORE_SERVICE_CMDLINE_OPTION "--core-service"
+#define TC_CORE_SERVICE_NO_FORK_CMDLINE_OPTION "--core-service-no-fork"
 }
 
 #endif // TC_HEADER_Core_Unix_CoreService

src/Core/Unix/CoreService.h

@@ -21,14 +21,12 @@
 #ifdef TC_LINUX
 #include <sys/utsname.h>
 #endif
-#ifdef TC_OPENBSD
-#include <pwd.h>
-#endif
 #include <stdio.h>
 #include <unistd.h>
 #include "Platform/FileStream.h"
 #include "Platform/MemoryStream.h"
 #include "Platform/SystemLog.h"
+#include "Core/Unix/UnixUser.h"
 #include "Driver/Fuse/FuseService.h"
 #include "Volume/VolumePasswordCache.h"
 
@@ -43,26 +41,6 @@ namespace VeraCrypt
 	static bool SamePath (const string& path1, const string& path2);
 #endif
 
-#ifdef TC_OPENBSD
-	static bool GetDoasUserIds (uid_t *uid, gid_t *gid)
-	{
-		const char *env = getenv ("DOAS_USER");
-		if (!env || !env[0])
-			return false;
-
-		struct passwd *pw = getpwnam (env);
-		if (!pw)
-			return false;
-
-		if (uid)
-			*uid = pw->pw_uid;
-		if (gid)
-			*gid = pw->pw_gid;
-
-		return true;
-	}
-#endif
-
 	// Struct to hold terminal emulator information
 	struct TerminalInfo {
 		const char* name;
@@ -657,11 +635,9 @@ namespace VeraCrypt
 			catch (...) { }
 		}
 
-#ifdef TC_OPENBSD
 		gid_t doasGid;
 		if (GetDoasUserIds (nullptr, &doasGid))
 			return doasGid;
-#endif
 
 		return getgid();
 	}
@@ -679,11 +655,9 @@ namespace VeraCrypt
 			catch (...) { }
 		}
 
-#ifdef TC_OPENBSD
 		uid_t doasUid;
 		if (GetDoasUserIds (&doasUid, nullptr))
 			return doasUid;
-#endif
 
 		return getuid();
 	}

src/Core/Unix/CoreUnix.cpp

@@ -0,0 +1,74 @@
+/*
+ Derived from source code of TrueCrypt 7.1a, which is
+ Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed
+ by the TrueCrypt License 3.0.
+
+ Modifications and additions to the original source code (contained in this file)
+ and all other portions of this file are Copyright (c) 2013-2026 AM Crypto
+ and are governed by the Apache License 2.0 the full text of which is
+ contained in the file License.txt included in VeraCrypt binary and source
+ code distribution packages.
+*/
+
+#ifndef TC_HEADER_Core_Unix_UnixUser
+#define TC_HEADER_Core_Unix_UnixUser
+
+#include <errno.h>
+#include <pwd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <vector>
+
+#define TC_DOAS_CORE_SERVICE_ENV "VERACRYPT_DOAS_CORE_SERVICE"
+
+namespace VeraCrypt
+{
+	static inline bool GetDoasUserIds (uid_t *uid, gid_t *gid)
+	{
+		if (getuid () != 0 || geteuid () != 0 || getenv ("SUDO_UID") || getenv ("SUDO_GID"))
+			return false;
+
+#ifndef TC_OPENBSD
+		const char *trustedDoasService = getenv (TC_DOAS_CORE_SERVICE_ENV);
+		if (!trustedDoasService || strcmp (trustedDoasService, "1") != 0)
+			return false;
+#endif
+
+		const char *env = getenv ("DOAS_USER");
+		if (!env || !env[0])
+			return false;
+
+		long bufferSize = 16384;
+#ifdef _SC_GETPW_R_SIZE_MAX
+		long sysconfBufferSize = sysconf (_SC_GETPW_R_SIZE_MAX);
+		if (sysconfBufferSize > 0)
+			bufferSize = sysconfBufferSize;
+#endif
+
+		struct passwd pw;
+		struct passwd *pwResult = nullptr;
+		std::vector <char> buffer (static_cast <size_t> (bufferSize));
+		int status;
+
+		while ((status = getpwnam_r (env, &pw, &buffer[0], buffer.size(), &pwResult)) == ERANGE)
+		{
+			if (buffer.size () > 1024 * 1024)
+				return false;
+			buffer.resize (buffer.size () * 2);
+		}
+
+		if (status != 0 || !pwResult)
+			return false;
+
+		if (uid)
+			*uid = pw.pw_uid;
+		if (gid)
+			*gid = pw.pw_gid;
+
+		return true;
+	}
+}
+
+#endif // TC_HEADER_Core_Unix_UnixUser

src/Core/Unix/UnixUser.h

@@ -40,9 +40,6 @@
 #include <stdio.h>
 #include <unistd.h>
 #include <time.h>
-#ifdef TC_OPENBSD
-#include <pwd.h>
-#endif
 #include <sys/mman.h>
 #include <sys/statvfs.h>
 #include <sys/time.h>
@@ -55,6 +52,7 @@
 #include "Platform/SystemLog.h"
 #include "Platform/Unix/Pipe.h"
 #include "Platform/Unix/Poller.h"
+#include "Core/Unix/UnixUser.h"
 #include "Volume/EncryptionThreadPool.h"
 #include "Core/Core.h"
 
@@ -68,26 +66,6 @@ namespace VeraCrypt
 	static const uint64 VC_FUSE_METADATA_SIZE = 64 * 1024;
 	static const uint64 VC_FUSE_STAT_BLOCK_SIZE = 512;
 
-#ifdef TC_OPENBSD
-	static bool fuse_service_get_doas_user_ids (uid_t *uid, gid_t *gid)
-	{
-		const char *env = getenv ("DOAS_USER");
-		if (!env || !env[0])
-			return false;
-
-		struct passwd *pw = getpwnam (env);
-		if (!pw)
-			return false;
-
-		if (uid)
-			*uid = pw->pw_uid;
-		if (gid)
-			*gid = pw->pw_gid;
-
-		return true;
-	}
-#endif
-
 	static uint64 fuse_service_ceil_div (uint64 value, uint64 divisor)
 	{
 		return (value / divisor) + ((value % divisor) ? 1 : 0);
@@ -813,18 +791,16 @@ namespace VeraCrypt
 			}
 			catch (...) { }
 		}
-#ifdef TC_OPENBSD
 		else
 		{
 			uid_t doasUid;
 			gid_t doasGid;
-			if (fuse_service_get_doas_user_ids (&doasUid, &doasGid))
+			if (GetDoasUserIds (&doasUid, &doasGid))
 			{
 				FuseService::UserId = doasUid;
 				FuseService::GroupId = doasGid;
 			}
 		}
-#endif
 
 		static fuse_operations fuse_service_oper;
 

src/Driver/Fuse/FuseService.cpp

@@ -17,6 +17,7 @@
 #include "Platform/SystemLog.h"
 #include "Volume/EncryptionThreadPool.h"
 #include "Core/Unix/CoreService.h"
+#include "Core/Unix/UnixUser.h"
 #include "Main/Application.h"
 #include "Main/Main.h"
 #include "Main/UserInterface.h"
@@ -43,12 +44,16 @@ int main (int argc, char **argv)
 
 		setenv ("PATH", sysPathStr.c_str(), 1);
 
-		if (argc > 1 && strcmp (argv[1], TC_CORE_SERVICE_CMDLINE_OPTION) == 0)
+		if (argc > 1 && (strcmp (argv[1], TC_CORE_SERVICE_CMDLINE_OPTION) == 0 || strcmp (argv[1], TC_CORE_SERVICE_NO_FORK_CMDLINE_OPTION) == 0))
 		{
 			// Process elevated requests
 			try
 			{
-				CoreService::ProcessElevatedRequests();
+				bool forkProcess = strcmp (argv[1], TC_CORE_SERVICE_CMDLINE_OPTION) == 0;
+				if (!forkProcess)
+					setenv (TC_DOAS_CORE_SERVICE_ENV, "1", 1);
+
+				CoreService::ProcessElevatedRequests (forkProcess);
 				return 0;
 			}
 			catch (exception &e)

src/Main/Unix/Main.cpp

@@ -41,6 +41,7 @@ namespace VeraCrypt
 		virtual ~Thread () { };
 
 		void Join () const;
+		void Detach () const;
 		void Start (ThreadProcPtr threadProc, void *parameter = nullptr);
 
 		void Start (Functor *functor)

src/Platform/Thread.h

@@ -45,6 +45,13 @@ namespace VeraCrypt
 			throw SystemException (SRC_POS, status);
 	}
 
+	void Thread::Detach () const
+	{
+		int status = pthread_detach (SystemHandle);
+		if (status != 0)
+			throw SystemException (SRC_POS, status);
+	}
+
 	void Thread::Start (ThreadProcPtr threadProc, void *parameter)
 	{
 		PthreadAttr attr;