Require touch even for cached sudo - is it possible?

[mitsukuri]

Hello!

I wonder if it's possible to set pam-u2f up in such a way that a touch is always required for sudo even if it's called before the last sudo cache timeout? Currently if sudo is called within the timeout timeframe, it requires neither a password nor a touch. Basically, I'd like to enter my sudo password e.g. once in 10 minutes, but still confirm every invocation with a touch.

[LDVG]

Hi,

Sorry, I'm no expert on sudo and its cache policies (e.g. if a different PAM stack can be used in the cached scenario) -- I don't know of a suitable solution. Note that there was a similar ask in a pull request recently that involved implementing more service functions in pam-u2f but we concluded that it seemed too much of a workaround for us to pull in.

[mitsukuri]

Hi Ludvig, thanks for chiming in!

That PR description does look exactly like what I had in mind. The reason for rejection is understandable, though.