Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

How might I use script /usr/bin/su-to-root after I have intentionally locked the root account?

Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic Package Manager" has default command:

su-to-root -X -c /usr/sbin/synaptic

which fails even though I provide the correct root password.

I have locked the root account (via command sudo passwd -l root) after granting my normal user sudo access via file /etc/sudoers.

Via the su-to-root man page, I tried modifying the command to use a specific user:

su-to-root -X -p "user" -c /usr/sbin/synaptic

but this did not seem to work.

In both cases, after three failed authentications, I receive message:

"Starting without administrative privileges. You will not be able to apply any changes. But you can still export the marked changes or create a download script for

Any ideas?

Traces of the script:

k@bucket:/tmp$ bash -x /tmp/su-to-root -X -c /usr/sbin/synaptic
+ test -r /etc/su-to-rootrc
+ test -r /home/k/.su-to-rootrc
+ PRIV=root
+ COMMAND=
+ NEEDS=text
++ which gettext
+ gettext=/usr/bin/gettext
+ for i in '"$@"'
+ case "$prev" in
+ prev=-X
+ for i in '"$@"'
+ case "$prev" in
+ NEEDS=X11
+ prev=-c
+ for i in '"$@"'
+ case "$prev" in
+ COMMAND=/usr/sbin/synaptic
+ prev=/usr/sbin/synaptic
+ '[' -z /usr/sbin/synaptic ']'
++ id -u
+ euid=1000
++ id -u root
+ privid=0
+ test 1000 = 0
+ case $NEEDS in
+ test -z ''
+ which gksu
+ SU_TO_ROOT_X=gksu
+ test X = Xtrue
+ case $SU_TO_ROOT_X in
+ gksu -u root /usr/sbin/synaptic
k@bucket:/tmp$ 

and

k@bucket:/tmp$ bash -x /tmp/su-to-root -X -p k -c /usr/sbin/synaptic
+ test -r /etc/su-to-rootrc
+ test -r /home/k/.su-to-rootrc
+ PRIV=root
+ COMMAND=
+ NEEDS=text
++ which gettext
+ gettext=/usr/bin/gettext
+ for i in '"$@"'
+ case "$prev" in
+ prev=-X
+ for i in '"$@"'
+ case "$prev" in
+ NEEDS=X11
+ prev=-p
+ for i in '"$@"'
+ case "$prev" in
+ PRIV=k
+ prev=k
+ for i in '"$@"'
+ case "$prev" in
+ prev=-c
+ for i in '"$@"'
+ case "$prev" in
+ COMMAND=/usr/sbin/synaptic
+ prev=/usr/sbin/synaptic
+ '[' -z /usr/sbin/synaptic ']'
++ id -u
+ euid=1000
++ id -u k
+ privid=1000
+ test 1000 = 1000
+ sh -c /usr/sbin/synaptic
k@bucket:/tmp$ 
share|improve this question
add comment

1 Answer

It seems script /usr/bin/su-to-root compares the euid of the user running su-to-root to the euid of either account root (default) or the user-specified account:

euid=$(id -u)
privid=$(id -u $PRIV)
if test "$euid" = "$privid"; then
  sh -c "$COMMAND"

If the euid's match, su-to-root skips authentication and runs command sh -c /usr/sbin/synaptic straightaway, skipping gksu/kdesu/ktsuss/sux/and so forth.

So, it seems /usr/bin/su-to-root assumes the calling user has root privileges and does not authenticate...which seems to represent a valid assumption in Debian.

As a work-around, I changed the Debian menu item command from su-to-root -X -p "user" -c /usr/sbin/synaptic to gksu -S /usr/sbin/synaptic.

From man gksu:

--sudo-mode, -S : Force gksu to use sudo(1) as its backend for running the programs.

This seems to force sudo, which represents what I want. Synaptic Package Manager authenticates, if needed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.