New answers tagged

1

According to strace lsof opens device files with read and write permissions: open("/dev/bus/usb/003/001", O_RDWR) = -1 EACCES (Permission denied) You can use capability CAP_DAC_OVERRIDE to give root's power to read and write any file in a system only to lsusb utility runned by specific user. This answer provides general instructions how to set up ...


3

The problem you are having is not a sudo problem, but a root permission problem. The filesystem that has hduser's home directory is not local to the machine and doesn't grant root permission to it. So when you did su - hduser you automatically changed to that directory, so sudo ls tried to run the ls command as root and that is where the error came from. ...


3

The www-data user is evidently configured with /sbin/nologin (or equivalent) as its shell, and thus the system will not allow you to login to that account. sudo lets you run a command as any user on the system, not just root. To clone the repo, you just need to sudo -u www-data git clone ... If you really need shell access as that user, sudo -u www-data ...


0

You might be able to get the information from udev, if it has noticed the device. For example I have a UPS device $ lsusb | grep UPS Bus 004 Device 041: ID 0463:ffff MGE UPS Systems UPS Using the bus and device numbers (004/041) I can get information from udevadm without being root. This includes a ID_SERIAL_SHORT value which is the same as the iSerial ...


1

No one has a ✓ yet, so I put together an answer that has everything I could think of. 1 When you run an executable, sometimes the OS will deny your permission to. For example running make install with the prefix being a system path will need sudo, while with the prefix being a non-system path will not be asked for sudo. How does the OS decide that running ...


0

I will add this : Dont make the script to be called directly, but to call a secondary script, the first script will be used to do log: #!/bin/bash [ "$USER" != "www-data" ] && exit set -a sudo realscript &>/var/log/myscript.log and the realscript: [ "$USER" != "root" ] && exit In sudo, put the realscript as sudo permitted ...


2

You take that comment out of context. This line is useful when building ports: permit nopass keepenv root as root Building ports always calls doas. Without the line above, this would restrict environment variables even when building ports as root. With said line building ports as root is done with the full environment.


0

Setting aside whether your approach is a good idea or not, if mycommand is interactive you should inhibit shell escapes using the noexec directive. This prevents the execution of other commands by presetting the exec() system calls to do nothing. (This is achieved through the mechanisms around LD_PRELOAD, see sudo.conf(5).) Caveat: this is not bulletproof - ...


2

One of the best thing is to use the "Digest_Spec" possibility in the sudoers file, to validate the checksum of your executable Extract of the man page: If a command name is prefixed with a Digest_Spec, the command will only match successfully if it can be verified using the specified SHA-2 digest. Using openssl, to generate the checksum: $ openssl ...


2

Two lines should be enough for raspberrian (doc), assuming you are using the version based on debian wheezy (check with lsb_release -a): deb http://archive.raspbian.org/raspbian wheezy main contrib non-free deb-src http://archive.raspbian.org/raspbian wheezy main contrib non-free "after changing sources.list don't forget to sudo apt-get update" (thanks ...


3

Things that can affect the setuid program Let's consider some ways the calling user could affect the behavior of the setuid process. I'll divide the things to consider in three groups: 1) the program itself, 2) the input to the program, and 3) the environment it runs in. The binary: If the unprivileged user can modify the binary that will be run, that ...


4

I'd amend your list of criteria for protecting a script a little. Given this - or a similar - entry in /etc/sudoers: www-data ALL=(ALL) NOPASSWD: /usr/local/sbin/mycommand we can state that the script: must be writeable only by the root user must be readable and executable by the root user must be in a hierarchy of directories that can only be written ...


0

What else can be done to secure a sudo-powered script: use PAM - pluggable authentication modules. PAM administrators guide: http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html PAM module writer's guide: http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_MWG.html PAM application developer's guide: http://www.linux-pam.org/Linux-PAM-html/Linux-...


0

I was seeing a similar Error, without the missing double quote, with the same version of sudo -- 1.8.6p3 on centos 6.5. It looks like visudo wanted the equals syntax -- Defaults mailto = "xxx@xx.com" Defaults mail_always Specifying Defaults mailto "xxx@xx.com" Defaults mail_always on Resulted in a syntax error for both entries.


3

You can use the -c option of su to pass a single command. su root -c 'sh /home/jay/script-that-needs-executing-as-root.sh'


6

What is the error I get with login? When searching trough the source code of login, we see this passage: amroot = (getuid () == 0); [...] utent = get_current_utmp (); /* * Be picky if run by normal users (possible if installed setuid * root), but not if run by root. This way it still allows logins * even if your getty is broken, or if something ...


1

have you tried sudo ? if sudo -u sysadmin /bin/ping -c ... you must edit /etc/sudoers as root with %g1 ALL=(sysadmin) NOPASSWD: /bin/ping to allow people group group g1 to run ping command. see man sudo, man sudoers and http://askubuntu.com/questions/192050/how-to-run-sudo-command-with-no-password for details.


-1

Probably your ping executable is missing the SUID bit. When you run ls -l $(which ping) you should see something like this: -rwsr-xr-x 1 root root 38200 Jul 23 2015 /bin/ping probably you do not have the s permission on the the 4th character from the beginning of line. Solution is simple. Run command: chmod u+s `which ping` as root or using su or ...


0

Your shell is now a file that invokes 'sudo -i' Swish. I've done it, but I don't think that's how I did it. Try that. If it sucks, I'll think harder.


4

Named pipe approach. As root, run mkfifo -m 666 /tmp/foo /tmp/readpipe.sh & And can, as user www-data then write to the pipe echo test >>/tmp/foo readpipe.sh in its simplest form (perl with taint would be better) : #!/bin/sh while read A </tmp/foo do echo received $A done


0

In the general case what you're trying to do doesn't really work. With aliases, there is pretty much just a string rewrite before the line is passed for execution. So, for example, if you have alias sudo='sudo ' alias foo='bar baz' then when you enter sudo foo the command line is rewritten to sudo bar baz and that is then what is run. This is simple ...


0

From what I know it's sudo -i OR su


4

The command is sudo. Add a line such as below into /etc/sudoers sigis ALL=(ALL) NOPASSWD: ALL This means user sigis can now run things like the command below without requiring password. sudo shutdown -h now


2

The best thing to do is never use pip outside of a virtualenv, so there is never a need to sudo pip, ever. For you system installs of python packages the dependencies within the package manager should take care. Use separate virtualenvs for each of your python utilities/programs. This allows you to run appropriate python versions and prevents you from '...


0

You need to use the dash as in: sudo su - me That way you run in me's environment and not the environment you come from.


4

sudo by default uses a minimal PATH, to make it safe for use by the root user. That is not necessarily the same as the PATH you would get by logging in as the root user, or by doing sudo su - For instance, in newer Red Hat releases, I've noticed that the path omits /usr/local/bin. The manual page summarizes this in a section entitled Security Notes: ...


7

cd is a shell builtin, and sudo only works with programs. Try using either su - or sudo -i before changing directory. These will elevate your login session to that of the root user. Once finished making changes, make sure to type exit to return to being a normal user.


0

I am having the same issue with Kali anytime I want to add newuser to the sudo group by typing this command: usermod -aG sudo newuser and editing the right section in /etc/sudoers. All crap! My fix for this nonsense is to copy the line for root below it and changing root to newuser: # User privilege specification root ALL=(ALL:ALL) ALL newuser ALL=(...


6

Sudoers wildcards are only supported with globbing (man glob, man fnmatch). Yet, the start, stop, restart (, etc.) commands for systemctl cannot be globbed since they are not files. The fact that you need to enumerate every command is a good thing from a security standpoint. If dhcpcd@eth0.service is updated with a command, say shutdown-machine on a ...


3

The directory is on an NFS-mounted filesystem. Likely, the NFS server has exported it with the root_squash option (default on most systems), meaning that for access to this filesystem, the root user is mapped to the nobody user, and is thus subject to the permissions for 'others' for the directory. Possible actions: Don't use root for accessing this ...


2

Just figured out the problem. When you giving privileges from other then the root user, then you need to specify user at the sudo command. See below example: This command run by cat and it works. sudo -u dog vim /home/dog/test.txt


3

If you know the root password then you can do $ su root # rm /etc/sudoers.d/jupyter visudo will validate the sudo files if in edit mode; you ran it in export mode...


-1

If you would type sudo -s in the terminal then all command afterward will be executed as sudo, but I would not suggest staying in such mode if not necessary.


0

Just in case anyone was wondering this is what I did to fix this problem. Fix: sudo setfacl -R -b This recursively (-R) removes all (-b) acl permissions I was also getting a group write warning for the following files: /var/lib/sudo/lectured /var/lib/sudo/ts Fix: sudo chmod 700 for both of the files and that correct the permissions and it fixed ...


1

Answering the second part of the question, how to write messages while waiting at the sudo prompt: trap '2>/dev/null' CHLD (sleep 5; echo; echo "New spam has just arrived!") & MSGPID=$! sudo -v wait $MSGPID trap - CHLD sleep 5 in the subshell simulates the message arriving asynchronously. The first echo just makes sure the message doesn't end up ...


2

As root edit /etc/sudoers and place the following line: youruser ALL=(ALL) NOPASSWD:ALL after # Allow members of group sudo to execute any command %sudo ALL=(ALL:ALL) ALL In this way you will be capable to execute all commands that require sudo privileges passwordless. In order to use sudo and be prompted for a password you need to remove ...


4

Like the accepted answer, I don't think this is possible directly. However, I see at least two ways to still accomplish your goal. Running vim remotely ssh user@myserver sudo vim /some/file This has disadvantages: Your interactions with vim go over the network. Significant lag will be annoying, and if your connection dies, so does vim (eventually). ...


2

You would need the root password or have your public ssh key in ~root/.ssh/authorized_keys. Once you had that, you could probably do vim scp://root@nagios//tmp/notouch Bottom line: this is effectively just a shortcut for scp root@nagios:/tmp/notouch /tmp/notouch vim /tmp/notouch scp /tmp/notouch root@nagios:/tmp/notouch If you have the necessary access ...


8

I'm going to say this is not possible because vim is not executing remote commands. It is simply using scp to copy the file over, edit it locally and scp it back when done. As stated in this question sudo via scp is not possible and it is recommended that you either modify permissions to accomplish what you're wanting or just ssh across to the remote machine....


0

Sudo is a popular command for raising a normal user's privileges. I'd guess that you are logging in directly as root, in which case there's no need to use sudo - everything you do is already sudoed, effectively.



Top 50 recent answers are included