How to automaticaly enter sudo's grace period upon login

Question

Knowing that giving a user a sudo's grace period right from the point when he/she login might be a security issue, I still think it will be a beneficial trade-off between security and usability in my setup.

The question is: how to do that? As far as I know, the sudo doesn't provide CLI for it.

I might somehow divert the gdm's typed password to something like sudo false, but again: how to get hold of the provided by the user password in the plain text? Should I write a custom pam module for it?

Or maybe it is better to immerse into implementation details of the sudo and as a root directly manipulate the timestamp database?

Answer 1

Gross hack, not really tested:

• Add the following line to /etc/pam.d/gdm:

  # Update the sudo ticket; proceed whether this succeeds or fails
  session [success=ignore new_authtok_reqd=ignore] optional pam_exec.so seteuid /usr/local/sbin/update_sudo_ticket
  

• Content of /usr/local/sbin/update_sudo_ticket:

  #!/bin/sh
  DIR=/var/run/sudo/$PAM_USER
  if [ -d "$DIR" ]; then touch "$DIR"; else mkdir "$DIR"; fi
  

You must have the tty_ticket option turned off in /etc/sudoers (otherwise, it doesn't make sense anyway: a Gdm login wouldn't count for whatever you do in a virtual terminal in your X session).

I don't guarantee that this works. I don't guarantee that this doesn't introduce a glaring security hole. Use at your own risk.

Answer 2

Gilles had inspired me to the following, simpler and even more dirty solution (user name is hard-coded). Make sure that executable file /etc/mdm/PostLogin/Default in Linux-Mint Mate (/etc/gdm/PostLogin/Default in Ubuntu) contains the following line:

touch /var/lib/sudo/<User Name>

Where <User Name> should be subsituted with the actual user name.