Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Knowing that giving a user a sudo's grace period right from the point when he/she login might be a security issue, I still think it will be a beneficial trade-off between security and usability in my setup.

The question is: how to do that? As far as I know, the sudo doesn't provide CLI for it.

I might somehow divert the gdm's typed password to something like sudo false, but again: how to get hold of the provided by the user password in the plain text? Should I write a custom pam module for it?

Or maybe it is better to immerse into implementation details of the sudo and as a root directly manipulate the timestamp database?

share|improve this question
up vote 2 down vote accepted

Gross hack, not really tested:

  • Add the following line to /etc/pam.d/gdm:

    # Update the sudo ticket; proceed whether this succeeds or fails
    session [success=ignore new_authtok_reqd=ignore] optional pam_exec.so seteuid /usr/local/sbin/update_sudo_ticket
    
  • Content of /usr/local/sbin/update_sudo_ticket:

    #!/bin/sh
    DIR=/var/run/sudo/$PAM_USER
    if [ -d "$DIR" ]; then touch "$DIR"; else mkdir "$DIR"; fi
    

You must have the tty_ticket option turned off in /etc/sudoers (otherwise, it doesn't make sense anyway: a Gdm login wouldn't count for whatever you do in a virtual terminal in your X session).

I don't guarantee that this works. I don't guarantee that this doesn't introduce a glaring security hole. Use at your own risk.

share|improve this answer
    
Wouldn't running sudo -v -u $PAM_USER instead of the script have been a better solution? – Piotr Dobrogost Apr 10 at 20:01
    
@PiotrDobrogost Would you be running that as root or as the user who's logging in? If you run that as root, it updates root's sudo ticket, which is not useful. If you run it as the user who's logging in, it requires them entering the password again. – Gilles Apr 10 at 20:12

Gilles had inspired me to the following, simpler solution. Make sure that executable file /etc/mdm/PostLogin/Default in Linux-Mint Mate (/etc/gdm/PostLogin/Default in Ubuntu) contains the following line:

touch /var/lib/sudo/$LOGNAME
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.