gsudo and the Elevation Prompt "details problem"

[bilbothebaggins]

I'm currently looking into using gsudo to elevate from within a build utility script for our devs.
It works a charm, BUT:

The way gsudo works means that the elevation prompt will be shown for the secondary gsudo instance that does the token elevation.
And this means the command line of this sudo -- which is what can be checked on the elevation prompt -- will not contain any trace of what is currently elevated. (e.g. ...gsudo.exe gsudoelevate 16904 S-1-5-21-.... Info 00:00:00

So, my Idea, if you will, would be to somehow make the command that is run visible from the elevation prompt. The naive solution may be for gsudo to provide a (non-functional) command line arg to itself so that looking into the details on the elevation prompt would allow me / the user to double check what program actually is elevated here.

The Windows elevation prompt is a bit of a problem with general tools like cmd, pwsh or gsudo, as what you are presented with on first glance is just the tool itself.

At least with the way cmd and pwsh are run with their scripts one can check the details on which script is invoked. gsudo does not allow this at all at the moment(?).

To be clear: For an interactive use of the tool, where I just launch it myself, this is a non issue.
But when using it "behind the scenes" in some utility script, it would be really great if there'd be a cheap option to see what is elevated directly in the elevation prompt.

cheers.

[gerardog]

Hi,
This is an interesting problem I've already gave some thoughts a while back.

If gsudo is used without cache (and cachemode != auto) the elevation is just for a 'single use', In this case, we could append the line to elevate in the command-to-elevate args (gsudo.exe gsudoelevate 16904 S-1-5-21-.... Info 00:00:00 -- my_command_to_elevate my_args). Plus a validation to ensure it matches the elevation request.

With cachemode=auto and no cache started, I could append the line, but after the elevation is done, the process would stay as cache and further elevations wont popup.

If user does gsudo cache on then the elevation cant show the command to elevate.

---

Another option would be to log to the console when elevating... But that would be fakable.

[bilbothebaggins]

Yeah I guess our use case would be strictly single use at this time.