2

I'm trying to find how is possible to execute a root command when a user starts their session.

I found that adding commands to this file /etc/rc.local should execute the commands after the boot, but my command is not being executed, or maybe the system is not ready yet to execute it. (the command works well)

Maybe an example could clarify what I'm trying to do. In almost all desktop managers there is an option at settings window called "Session and Start-up", and under the section "Application Auto-Start" it is possible to add commands that will be executed once the current user logs-in.

I'd like to do that but with a command that requires root permission.

  • 3
    Stuff that's in /etc/rc.local will be run once at system boot, before any one logs in. If it's not happening, the most likely reason is that it's being executed without any $PATH defined. Because of this, it's normal to use absolute paths in init scripts and rc.local. E.g. instead of: foobar -x -y -z use /usr/bin/foobar -x -y -z -- but again, to be clear, this doesn't run for every login. Just once at boot. If you are unsure of the correct path, check with which foobar or whereis foobar. – goldilocks Aug 10 '14 at 11:22
  • @goldilocks I guess i can create an script that scans when users log in and then execute the command. I took a look to my rc.local script and i found that i wasn't using absolute paths. Also i found that the script exits when it gets and error so i redirected the errors 2>> /path.. and by surprise i found errors! Kinda weird because long time ago this rc.local edit was working! – Rafael Senties Martinelli Aug 10 '14 at 12:35
  • 1
    Unprivileged users can run "setuid" programs and scripts from their personal startup plumbing (such as .profile or the desktop's startup items, etc). But almost everyone will shout "don't do it!" out of security concerns. Another approach is to cook some longer-running script that runs as root on startup (i.e. in rc.local is one way) and let it check for new user logins to trigger the privileged logic. – Stabledog Aug 10 '14 at 13:00
  • You can configure sudo to allow specified commands to be run as specified user, by specified users, without password. – ctrl-alt-delor Aug 10 '14 at 22:05
  • What problem are you actually trying to solve? This is probably not a good way to solve it. – Gilles Aug 10 '14 at 22:31
1

I found a solution creating a script that scans for users.

this is my /etc/rc.local script:

#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.


/usr/bin/detect_login 
exit 0

and this is the detect_login script:

#!/usr/bin/python2.7
# -*- coding: utf-8 -*-


import os, time

Buffer_list=[]
while True:
    users=os.popen('''who | cut -d' ' -f1 | sort | uniq''')
    users=users.read()
    Current_List=users.split('\n')
    Current_List=filter(None,Current_List)
    if Current_List:
        if Current_List != Buffer_list:

            if len(Current_List) > len(Buffer_list):

                #HERE YOU ADD THE COMMANDS, inside the triple quotes.
                # add each command in a new line

                # i let you an example for turning the brightness down..
                os.system('''/usr/bin/xdotool key XF86MonBrightnessDown''') 


            Buffer_list=Current_List

    time.sleep(0.5)

I advice to run once the script as root to check that it works fine, because if there is one error rc.local will stop. (Dumb errors can be for example indented spaces, it happens often when copying python scripts from stackexchange forums)

0

You might be interested in pam_exec. I use it to open extra ports to addresses that have successfully authenticated to sshd. My /etc/pam.d/sshd has

account    optional     pam_exec.so /usr/local/bin/update-whitelist

and the update-whitelist script looks like

#!/bin/sh

set -e

# Called from PAM when logging in via SSH.
# Adds current client to SSH whitelist.

WHITELIST=/proc/net/xt_recent/WHITELIST

test -n "$PAM_RHOST"
test -f "$WHITELIST"

# Handle PAM_RHOST as hostname or IPv4 dotted-quad
if echo "$PAM_RHOST" | /bin/grep -P -q '^\d+\.\d+\.\d+\.\d+$'
then echo "+$PAM_RHOST" >"$WHITELIST"
else /usr/bin/host "$PAM_RHOST" | /bin/sed -n -e 's/.* has address /+/p' >"$WHITELIST"
fi

(I have iptables rules that use xt_recent with WHITELIST).

Also of interest may be libpam-script, which can run an arbitrary command as part of authentication or session start:

$ aptitude show  libpam-script 
Package: libpam-script
Version: 1.1.4-1
Priority: extra
Section: universe/admin
Description: PAM module which allows executing a script
 This module will allow you to execute scripts during authorization, password
 changes and sessions. This is very handy if your current security application
 has no PAM support but is accessible with perl or other scripts.
Homepage: http://sourceforge.net/projects/pam-script

I haven't actually used this, but it may be worth investigation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.