1

I installed the newest version of Debian and have no access to my own files when using the sudo command:

  • ls -> shows files in my home directory
  • sudo ls -> permission denied

My user is part of the sudoers group and has the following entry in the /etc/sudoers file:

user1 ALL=(ALL:ALL) ALL

I never had this problem before when using Ubuntu.

My home directory is on an NFSv4 filesystem.

  • 3
    Your problem is mst probably lying here --> My homedir is mounted over the network as nfs4. Your files' ownership and permissions are governed by the NFS server, not your user ID on the local box, even if you are the root user, locally. – MelBurslan Jun 29 '16 at 15:14
  • Yes that would make sense, is there any possibilty to fix this issue ? – jrsm Jun 29 '16 at 15:15
  • 2
    Not on your local machine. NFS server will need to be modified for client side root access, but it is a very big security headache and if you are in a corporate environment, I can almost guarantee, your storage admins are going to balk at it. – MelBurslan Jun 29 '16 at 15:18
3

The directory is on an NFS-mounted filesystem. Likely, the NFS server has exported it with the root_squash option (default on most systems), meaning that for access to this filesystem, the root user is mapped to the nobody user, and is thus subject to the permissions for 'others' for the directory.

Possible actions:

  1. Don't use root for accessing this directory. For example, if you're writing a script to scan users' home directories, sudo from root to each user in turn to examine their home:

    for user in `getent passwd | grep ':/home' | cut -d : -f1`
    do
         sudo -u "$user" \
             "$process_directory" "`getent passwd $user | cut -d : -f6`"
    done
    

    (I split the sudo line to separate options from the command)

  2. Change the permissions on the directory to allow read and search by the nobody user (e.g. chmod go+rx). This may or may not be acceptable to you; you will probably want to ensure that sensitive files such as ~/.ssh/ and cache directories are not world-readable.
  3. Change the exports on the server to remove the root_squash option. On Debian, this means editing /etc/exports to add no_root_squash to the list of options:

    srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check,no_root_squash)
    

    This will then allow root to access all files on that filesystem regardless of permissions, just as if the filesystem were local.

  • Thank you, how exactly do I sudo from root to a certain user ? – jrsm Jun 29 '16 at 15:40
  • You can use sudo -u username command - for example sudo -u rtm ls ~rtm/ to list the content of user rtm's file as rtm. If you first open a shell as root with the sudo -i command, you can use su username or su - username to become the user username (the - options gives you the user's environment). root is not prompted for password when su'ing to another user. You can also use su with sudo, eg. sudo su -c 'ls ~rtm' rtm - this may show you clearer that you first become root - then another user. – Baard Kopperud Jun 29 '16 at 16:55
  • Use of sudo is of course dependent on the entries in the /etc/sudoers file... "user ALL = (ALL) ALL" actually means that user may run ALL-commands as ALL-users (including root) on ALL-machines. The entries are "username machines = (run_as_user) commands". So if your user (or root) are not allowed to run commands as any other user, this won't work. If you first become root however, you can still use su user to become any other user without being prompted for password. You just can't do it with only sudo in one go... – Baard Kopperud Jun 29 '16 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.