Run commands as another passwordless user - sudo fails?

Question

I log on to my server as userA, this user has a bash shell, everything works fine with it.

Then, for the purposes of a program, I've had to do sudo adduser --system --home=/home/userB --group userB; this user is apparently passwordless, judging by the contents of /etc/passwd and /etc/shadow:

$ grep userB /etc/passwd
userB:x:Z08:WW9::/home/userB:/bin/false
$ sudo grep userB /etc/shadow
userB:*:16XXX:0:YYYYY:7:::

Also, there is no /home/userB/.profile, nor any /home/userB/.bash* files in the userB home directory.

Now, while I'm logged in as userA, I'd like to run commands as userB, in particular inspect the $PATH that userB sees. So I've tried to edit via EDITOR=/usr/bin/nano sudo visudo, and add either of the userA lines:

...
# User privilege specification
root    ALL=(ALL:ALL) ALL
#userA      ALL=(userB) NOPASSWD: /bin/bash
userA       ALL = (userB) NOPASSWD: ALL
...

... then save the file, logout from remote shell, re-login back as userA. Then I try running:

$ sudo -iu userB; echo $?
1
$ sudo -S -u userB -i /bin/bash -l -c 'echo $HOME'; echo $?
1
$ sudo -i -u userB echo \$HOME; echo $?
1

... and clearly, nothing works - and there is no error either. Then I thought I'd strace one of these commands, and indeed I got an error:

$ strace sudo -iu userB
...
write(2, "sudo: effective uid is not 0, is"..., 140sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
) = 140
exit_group(1)                           = ?
+++ exited with 1 +++

However, nosuid is not a problem on this root partition, I guess:

$ mount | grep '/ '
/dev/sdaX on / type ext4 (rw,errors=remount-ro)

So now I really have no idea what to do. Is it possible at all to have userA in this case run commands (e.g. print the $HOME environment variable) as userB - and if so, how can I get it to work?

Answer 1

The -i option in sudo attempts to create a login shell, which in turn launches the user's chosen shell. You have set this to /bin/false in your /etc/passwd:

$ grep userB /etc/passwd
userB:x:Z08:WW9::/home/userB:/bin/false

Try running:

sudo -u userB ls

If this works then it is all working as you have configured it to. If you want a interactive shell use -s instead which will not call the user's login shell.

If you want a full login shell you must change the user's shell with

sudo chsh -s /bin/bash userB

Answer 2

From the sudo manpage:

-i, --login
             Run the shell specified by the target user's password data-
             base entry as a login shell. 

Your userB has /bin/false as the shell, so that's the command that is run.

% /bin/false ; echo $? 
1

So to fix this you need to change the shell of userB to /bin/bash (or /bin/sh or whatever you prefer) or don't use the -i flag to sudo. Do you need a login shell?