Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Knowing that giving a user a sudo's grace period right from the point when he/she login might be a security issue, I still think it will be a beneficial trade-off between security and usability in my setup.

The question is: how to do that? As far as I know, the sudo doesn't provide CLI for it.

I might somehow divert the gdm's typed password to something like sudo false, but again: how to get hold of the provided by the user password in the plain text? Should I write a custom pam module for it?

Or maybe it is better to immerse into implementation details of the sudo and as a root directly manipulate the timestamp database?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Gross hack, not really tested:

  • Add the following line to /etc/pam.d/gdm:

    # Update the sudo ticket; proceed whether this succeeds or fails
    session [success=ignore new_authtok_reqd=ignore] optional pam_exec.so seteuid /usr/local/sbin/update_sudo_ticket
    
  • Content of /usr/local/sbin/update_sudo_ticket:

    #!/bin/sh
    DIR=/var/run/sudo/$PAM_USER
    if [ -d "$DIR" ]; then touch "$DIR"; else mkdir "$DIR"; fi
    

You must have the tty_ticket option turned off in /etc/sudoers (otherwise, it doesn't make sense anyway: a Gdm login wouldn't count for whatever you do in a virtual terminal in your X session).

I don't guarantee that this works. I don't guarantee that this doesn't introduce a glaring security hole. Use at your own risk.

share|improve this answer

Gilles had inspired me to the following, simpler and even more dirty solution (user name is hard-coded). Make sure that executable file /etc/mdm/PostLogin/Default in Linux-Mint Mate (/etc/gdm/PostLogin/Default in Ubuntu) contains the following line:

touch /var/lib/sudo/$LOGNAME
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.