9

Is it possible to assign the setuid bit to sudo in order to execute any command as a normal user?

Let's suppose that we have the user test and then:

test@test$ apt-get update

But I don't want to use sudo nor modify the sudoers file, is this possible using only the setuid bit?

2

2 Answers 2

19

If your account has sudo rights, then there's no need to mess with the suid bit. The following assumes Bash as your interactive shell, so you may have to modify steps 2&3 depending on what you use.


  1. Add these to the end of /etc/sudoers

    USERNAME HOST_NAME = (root) NOPASSWD: /usr/bin/apt-get
    USERNAME HOST_NAME = (root) NOPASSWD: /usr/bin/shutdown
    
  2. Add these to your ~/.bashrc

    alias shutdown='sudo shutdown'
    alias apt-get='sudo apt-get'
    
  3. Reload the startup config for the current session.

    $ source ~/.bashrc
    
  4. Now you can run the commands as a normal user without being prompted for a root/sudo password (and therefore, eliminate the need to know the password altogether).

    $ apt-get update
    $ apt-get upgrade
    $ shutdown -h now
    
3
  • 1
    IMHO this should be the accepted answer...
    – ScumCoder
    Commented Jul 3, 2021 at 15:13
  • 1
    @roaima Thanks for the correction. Edited my answer to reflect that.
    – user410559
    Commented May 19, 2022 at 13:08
  • 1
    Instead of changing /etc/sudoers, I would put the additional lines in /etc/sudoers.d/local. Keeps the original file clean and doesn't break on updates.
    – doneal24
    Commented May 19, 2022 at 14:28
16

Short answer: You can't execute arbitrary admin commands without either

  • a sudo, or
  • being root.

Long answer: You must either have NOPASSWD in /etc/sudoers, or log as root. See https://askubuntu.com/questions/147241/execute-sudo-without-password.

visudo

then add a line

username ALL=(ALL) NOPASSWD: ALL

As requested, if you want to run, as root, a specific binary file, you might use

chown root:wheel /usr/binary
chmod u+s /usr/binary

however, if program you want to run as root without sudo is a shell (or a python, awk, perl), you can't.

beware of pitfall, on my main ubuntu /usr/bin/shutdown is a link to /sbin/systemctl.

I would need to copy the later to the former before applying chmod/chown above.

6
  • For security, you can also set the NOPASSWD argument for specific commands as user ALL=NOPASSWD: /sbin/poweroff, /sbin/reboot
    – Peschke
    Commented Apr 15, 2016 at 0:39
  • 2
    @Peschke but you still need to use sudo poweroff, sudo reboot. The OP wanted to get rid of the sudo part.
    – telcoM
    Commented Sep 23, 2019 at 21:58
  • @telcoM yep, the answer above covered that. My comment was just expanding the answer.
    – Peschke
    Commented Sep 23, 2019 at 22:10
  • @Peschke I see, my mistake, sorry about the noise then.
    – telcoM
    Commented Sep 24, 2019 at 7:05
  • Does this remove the need for sudo for any command? Otherwise, how to achieve the same, but for one specific command (or an arbitrary set of them)? Commented Feb 18, 2021 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .