I am writing a script, that will setup lxc on the host, and then configure a container. I want this script to be unattended. After the container is created and run, there is a moment, when I want to log in as the user and perform some commands with sudo. I know how to setup ssh to let me login without asking any questions. The only bit that is left, is to make sure, that I can do the sudo.

I don't want to disable the sudo - I just want to mimic a situation, when the user actually puts the password.

So far I made the following:

if [ ! -d /var/lib/lxc/$puppetmastername/rootfs/var/lib/sudo/$user ]; then
    sudo mkdir /var/lib/lxc/$puppetmastername/rootfs/var/lib/sudo/$user
sudo touch /var/lib/lxc/$puppetmastername/rootfs/var/lib/sudo/$user/0

sudo grep '!tty_tickets' /etc/sudoers
if [ $? -ne 0 ]; then
    echo 'Defaults         !tty_tickets' >>/var/lib/lxc/puppetmaster/rootfs/etc/sudoers

Unfortunately, it is insufficient, the container still asks for password.

  • Since you're effectively allowing your program to run arbitrary commands as root, why aren't you running it as root in the first place? – Gilles Jul 27 '14 at 19:41
  • @Gilles because of the environment inheritance, that sudo provides. – Adam Ryczkowski Jul 27 '14 at 20:15

You must edit your /etc/sudoers file and grant your user permission to run some programs as root without password:

yourusername ALL = (root) NOPASSWD: /path/to/prog1, /path/to/prog2, ...

In your case, you can try:

myusername ALL = (root) NOPASSWD: /bin/mkdir, /usr/bin/touch, /bin/grep

You must check NOPASSWD entry is the last entry that match your user. If two entries in /etc/sudoers matches your user, NOPASSWD rule need to be after that one to take effects.

  • I know that technique, but it is troublesome - there is a lot of programs I need to run as root, and I want to run them only once. And I don't want to declare those programs in the sudoers file - this is error-prone. – Adam Ryczkowski Jul 26 '14 at 19:34
  • You could change the list of commands to the word ALL. Then you don't need to list them all. Then once the configuration has ended, replace the sudoers file with a sudoers file that doesn't have that line that grants the user effective root access. – Warwick Jul 28 '14 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.