2

I'm trying to run three separate nmcli commands

nmcli connection down config-AP

nmcli connection up config-AP

nmcli device wifi hotspot con-name config-AP ssid device band bg password password

If these aren't called as root they timeout

Error: Timeout 10 sec expired.

How can I allow these commands to run without adding a user to the sudoers file?

5
  • 4
    You do know that you don't need to allow unlimited access through sudo, but that you can list the programs a user is allowed to run with raised privilege? So the question is, if you have some other reason to avoid using sudo?
    – ilkkachu
    Commented May 10, 2017 at 18:44
  • @ilkkachu How is that done?
    – yujaiyu
    Commented May 19, 2022 at 16:30
  • 1
    @foki, you list the allowed commands in the /etc/sudoers config file. Like ilkkachu ALL = /bin/dmesg or so. See the man page, it has examples. Or look for tutorials online, there are probably better ones than any I could write.
    – ilkkachu
    Commented May 19, 2022 at 20:26
  • @ilkkachu Correct. However, that doesn't really look like an elegant solution to what OP wants. nmcli is an umbrella program that may use multiple other tools. For example, if it's a VPN, it might use openconnect, which in turn calls /etc/vpnc/vpnc-script, which then calls reslvconf and many others, etc... Exploring source code of a program and adding all programs that may be used doesn't look too practical.
    – yujaiyu
    Commented May 19, 2022 at 22:30
  • @foki, re. it being an umbrella program, I fail to see an issue with that. Anyway, I'm not sure how useful it is to make guesses on the wants and needs of a five-year-old post. Re. that "Correct.", if you're asking just to test if I know something, don't. Just post an answer of your own, thanks.
    – ilkkachu
    Commented May 20, 2022 at 7:23

1 Answer 1

4

If you have a command that can do no harm but needs root privileges you can change it to have "set user id" (set uid or suid) attribute. Here is an example:

ls -l /bin/chsh
-rwsr-xr-x 1 root root 23376 Mar 22 21:23 /bin/chsh*

This file has the "s" tag to show that during execution it will assume the root (3rd column) user id.

However, this is potentially dangerous and a local attacker able to call that command could overtake your system if the command itself is not programmed to handle being called suid 0. You have been warned.

Having said this, you could do:

chmod u+s,a-w /usr/bin/nmcli

(please change the path if necessary, e.g. to /bin/nmcli according to your system)

If you wish to restrict the people being able to call the (now dangerous) command you could make it accessible only to a special group, e.g. by

chgrp john /usr/bin/nmcli
chmod o= /usr/bin/nmcli

That way, only someone in the group john (and root) could call the command. Use a group only your user is in, ideally.

3
  • I should probably add that during a system update to that command the new attributes could be reset to default values. You can make them permanent on some systems but the way to do it varies. In openSUSE, for instance, this used to be done by creating /etc/permissions.local with an appropriate entry. (You could also call the commands again after an update to that file, it does not happen that often.)
    – Ned64
    Commented May 10, 2017 at 18:56
  • This is very unlikely to solve your problem. nmcli calls resolveconf. If you don't set s bit on resolvconf, then nmcli is useless. Otherwise, if you also set the s bit on resolveconf you're at a HUGE security risk.
    – yujaiyu
    Commented May 19, 2022 at 16:05
  • @foki If a root process creates a child process like resolveconf won't that also run as EUID 0?
    – Ned64
    Commented May 23, 2022 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .