Use async await with cockpit.script() or cockpit.spawn()

[neetabisht]

Explain what happens

Hi,
Here are my few queries. can anyone please suggest.

1. Where should we use cockpit.script() and cockpit.spawn() ?
2. With Async await which is better to use cockpit.script() / cockpit.spawn() ?

Here is my program:

async function filepermissionforcreateopr(dataLiteralStaticDns)
{
    let etcfilePermission = `echo '${password}' | sudo -S chmod 777 /etc/resolv.conf`;
    let etcfileper = cockpit.script(etcfilePermission);
    etcfileper.then((content) => {
              console.log("File permission given"); })
}

async function saveFileDataForCreateOpr(dataLiteralStaticDns)
{
    let filedata = cockpit.script(`cat /etc/resolv.conf`);
    filedata.then((content) => {
       console.log("File contents fetched successfully"); 
    })
    await filepermissionforcreateopr(dataLiteralStaticDns);
}

async function registerData(dataLiteralDpcm, dataLiteralEdge, dataLiteralStaticDns, dataLiteralOtel) {

   **await saveFileDataForCreateOpr(dataLiteralStaticDns);**

    let otel_pod = cockpit.script(`${rootpath}EdgeniusConfigurationJs/otel_update.sh`);
    otel_pod.then((content) => {
      console.log("Otel ran successfully"); 
      })
}

Here in this program I want saveFileDataForCreateOpr() to be executed completely before moving to subsequent code in registerData() function. Basically let otel_pod = cockpit.script(${rootpath}EdgeniusConfigurationJs/otel_update.sh); line should be executed only after saveFileDataForCreateOpr() is completed.

1 fix i gave inside saveFileDataForCreateOpr() as below:
let filedata = await cockpit.spawn(["cat", "/etc/resolv.conf"], { err: "out" });

For another function filepermissionforcreateopr() i am not getting how to give cockpit.spawn().
Thus wanted to know what best solution can be given in this scenario.

Version of Cockpit

No response

Where is the problem in Cockpit?

None

Server operating system

None

Server operating system version

No response

What browsers are you using?

No response

System log

No response

[martinpitt]

This needs some unpacking.

• You use .spawn() for an argv vector (run program without a shell), and .script() for a shell script. Avoid the latter as much as you can, especially with user-defined values, as shell scripts are super easy to break then.
• Both APIs work with await or promises (.then()), as you prefer. This independent of spawn vs. script.

let etcfilePermission = echo '${password}' | sudo -S chmod 777 /etc/resolv.conf;

Ugh, please don't do that -- there are so many things wrong here. It also nicely illustrates the problem with shell: Have a ' in your password and the command will explode. Also, where would you even get the password from?

You want

await cockpit.spawn(['chmod', '777', '/etc.resolv.conf'], { superuser: "required" });

But moreover, never do this on a production system with actual users -- making resolv.conf world-writable is a major security hole. (It may be an okay hack in some non-login VM, but you must know what you are doing)

And for reading the file, please use the proper file API:

const filedata = await cockpit.file("/etc/resolv.conf").read();

[martinpitt]

Cockpit can already run commands as root, when you authenticate in the UI. That's the { superuser: ... } option, see e.g. https://cockpit-project.org/guide/latest/cockpit-spawn.html. You should never run sudo in a cockpit page, and also never run any shell command including any password, as these are visible in cleartext in eg. ps aux for any unauthenticated user.

If you want to do some stdin for a command, for example a web service or other password which isn't the user/sudo password, use cockpit.spawn(....).input(my_password). This is much safer.

In general you should consult the API docs to get an overview what kind of operations you can do, and later use that as a reference for all the options. You can also check the existing cockpit, cockpit-podman etc. code with e.g. git grep cockpit.file or similar to see lots of existing examples.

[martinpitt]

There's also some intro articles on our website, I think https://cockpit-project.org/blog/creating-plugins-for-the-cockpit-user-interface.html is a good one to start.

[neetabisht]

Thanks a lot for the docs & links provided.

I checked few repos where i couldn't able to see any async/await operations with cockpit.script() & cockpit.spawn().
But few reference from search engine i got like below:

async function executeCommand(command) {
    return new Promise((resolve, reject) => {
        cockpit.script(command, (err, data) => {
            if (err) {
                reject(err);
            } else {
                resolve(data);
            }
        });
    });
}

async function myFunction() {
    try {
        const result = await executeCommand('cat /etc/resolv.conf ');
        console.log('Result:', result);
    } catch (error) {
        console.error('Error:', error);
    }
}

myFunction();

Hope this is fine?
Thanks

[martinpitt]

There's no need for wrapping cockpit.script() into an extra Promise. You are also calling this wrong, the (err, data) arrow callback is not a valid argument for cockpit.script(). This returns a promise, it doesn't do a callback.

As said above, just do const result = await cockpit.script("cat /etc/resolv.conf").

[neetabisht]

Now I understood fully.
Thanks a lot @martinpitt for quick response.