4

Whenever I've attempted to run growisofs via sudo I've always gotten the following error message.

$ sudo -i growisofs
:-( growisofs is being executed under sudo, aborting!
    See NOTES paragraph in growisofs manual page for further details.
$ sudo -s growisofs

:-( growisofs is being executed under sudo, aborting!
    See NOTES paragraph in growisofs manual page for further details.

Which leads me to having to do a sudo su - followed by growisofs.

$ sudo su - -c growisofs
growisofs: previous "session" device is not specified, do use -M or -Z option

-or-

$ sudo su -
# growisofs ...

Is there a alternative way I can do this without having to do the su -?

Background

This behavior is built into the tool growisofs to thwart giving access to the filesystem with elevated privileges.

excerpt

NOTES

If executed under sudo(8) growisofs refuses to start. This is done for the following reason. Naturally growisofs has to access the data set to be recorded to DVD media, either indirectly by letting mkisofs generate ISO9660 layout on-the-fly or directly if a pre-mastered image is to be recorded. Being executed under sudo(8), growisofs effectively grants sudoers read access to any file in the file system. The situation is intensified by the fact that growisofs parses MKISOFS environment variable in order to determine alternative path to mkisofs executable image. This means that being executed under sudo(8), growisofs effectively grants sudoers right to execute program of their choice with elevated privileges. If you for any reason still find the above acceptable and are willing to take the consequences, then consider running following wrapper script under sudo(8) in place for real growisofs binary.

       #!/bin/ksh
       unset SUDO_COMMAND
       export MKISOFS=/path/to/trusted/mkisofs
       exec growisofs "$@"

But note that the recommended alternative to the above "workaround" is actually to install growisofs set-root-uid, in which case it will drop privileges prior accessing data or executing mkisofs in order to preclude unauthorized access to the data.

6

What growisofs is doing here is looking for the SUDO_COMMAND environment variable, and aborting if the variable is found. The reason sudo su - works is because su - clears the environment.

Rather than having to get a full shell, you can do:

sudo env -i growisofs

This will wipe the environment, just like su -. The only difference is that su - will also put the basic variables (in /etc/profile and such) back, where as env -i wont (completely empty environment).

A more precise solution would be:

sudo env -u SUDO_COMMAND growisofs

This will preserve the environment except for SUDO_COMMAND.

1
  • Thanks Patrick - that solved my situation; I also did not know that it was checking SUDO_COMMAND. Using "env -i" worked 100% so +1 from me. On a side note: while I can understand growisofs author being wary, I think the "solution" to create a new wrapper shell script is horrible. There should be a simple way to disable this useless check during configure time; or the author should recommend the "env -i" variant because I believe it is superior to having to create a shell script (my system is already so cluttered up with different shell scripts - the last I want to do is add more shell scripts)
    – shevy
    Jan 12 '20 at 16:45
2
chmod u+s /usr/bin/growisofs solves this problem.

But it's a good example of the "wrong way to do this" since it breaks the security afforded through sudo. SetUID growisofs presents an even worse security problem than carefully configuring sudo and it's all of no value for a personal desktop system, IMO.

1
  • slm - thank you for finding better words and editing my comment.
    – dsamersoff
    May 19 '15 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.