0

I log on to my server as userA, this user has a bash shell, everything works fine with it.

Then, for the purposes of a program, I've had to do sudo adduser --system --home=/home/userB --group userB; this user is apparently passwordless, judging by the contents of /etc/passwd and /etc/shadow:

$ grep userB /etc/passwd
userB:x:Z08:WW9::/home/userB:/bin/false
$ sudo grep userB /etc/shadow
userB:*:16XXX:0:YYYYY:7:::

Also, there is no /home/userB/.profile, nor any /home/userB/.bash* files in the userB home directory.

Now, while I'm logged in as userA, I'd like to run commands as userB, in particular inspect the $PATH that userB sees. So I've tried to edit via EDITOR=/usr/bin/nano sudo visudo, and add either of the userA lines:

...
# User privilege specification
root    ALL=(ALL:ALL) ALL
#userA      ALL=(userB) NOPASSWD: /bin/bash
userA       ALL = (userB) NOPASSWD: ALL
...

... then save the file, logout from remote shell, re-login back as userA. Then I try running:

$ sudo -iu userB; echo $?
1
$ sudo -S -u userB -i /bin/bash -l -c 'echo $HOME'; echo $?
1
$ sudo -i -u userB echo \$HOME; echo $?
1

... and clearly, nothing works - and there is no error either. Then I thought I'd strace one of these commands, and indeed I got an error:

$ strace sudo -iu userB
...
write(2, "sudo: effective uid is not 0, is"..., 140sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
) = 140
exit_group(1)                           = ?
+++ exited with 1 +++

However, nosuid is not a problem on this root partition, I guess:

$ mount | grep '/ '
/dev/sdaX on / type ext4 (rw,errors=remount-ro)

So now I really have no idea what to do. Is it possible at all to have userA in this case run commands (e.g. print the $HOME environment variable) as userB - and if so, how can I get it to work?

  • 2
    A * in the password field in /etc/shadow means "no login", rather than "no password". – Satō Katsura Sep 13 '16 at 15:38
  • 2
    You can't strace setuid programs; the setuid flag is ignored if you try. – Stephen Harris Sep 13 '16 at 15:41
  • 1
    Set a password with passwd userB. – Satō Katsura Sep 13 '16 at 15:43
  • 1
    What happens if you change userB's shell to /bin/bash? Currently it is set to /bin/false. – Stephen Harris Sep 13 '16 at 15:43
  • 1
    @SatoKatsura userB does not need a password because no userB credentials are ever being asked for. * is good, here. – Stephen Harris Sep 13 '16 at 15:44
1

From the sudo manpage:

-i, --login
             Run the shell specified by the target user's password data-
             base entry as a login shell. 

Your userB has /bin/false as the shell, so that's the command that is run.

% /bin/false ; echo $? 
1

So to fix this you need to change the shell of userB to /bin/bash (or /bin/sh or whatever you prefer) or don't use the -i flag to sudo. Do you need a login shell?

  • Many thanks @StephenHarris - that explains it; cheers! – sdbbs Sep 13 '16 at 16:16
2

The -i option in sudo attempts to create a login shell, which in turn launches the user's chosen shell. You have set this to /bin/false in your /etc/passwd:

$ grep userB /etc/passwd
userB:x:Z08:WW9::/home/userB:/bin/false

Try running:

sudo -u userB ls

If this works then it is all working as you have configured it to. If you want a interactive shell use -s instead which will not call the user's login shell.

If you want a full login shell you must change the user's shell with

sudo chsh -s /bin/bash userB
  • Many thanks @MichaelDaffin - indeed, sudo -u userB ls even with /bin/false in /etc/passwd; great to know this! – sdbbs Sep 13 '16 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.