Why NOPASSWD in visudo on Linux Mint 18 does not work

Question

This is a sudoers file which I have on a Debian 9 server and it works. /etc/sudoers contains:

Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root        ALL=(ALL:ALL) ALL
# the following line I've added for sudo to work on Debian, which by default does not
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

Meaning I can now run e.g. the following without entering password:

sudo teamviewer daemon disable
sudo teamviewer daemon enable

This, however, is a non-working sudoers file on Linux Mint 18 in a sense, it still asks me for password. /etc/sudoers contains:

Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root        ALL=(ALL:ALL) ALL
# this line I've added myself, because I felt it is needed, however user vlastimil has had sudo access all the time, added just now
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish, but it does not work
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

I guess there is some difference between Debian and Mint, which makes the added lines non-working.

I read different answers like on this page:

How to run a specific program as root without a password prompt?

But I am not clever from it.

EDIT1:

The first answer gives on Linux Mint a strange error:

$ sudo /usr/bin/teamviewer
 Init...
 *** TeamViewer can not be executed with sudo! ***
 Either use your normal user account without sudo
 or use a the real root account to log in to your desktop (not recommended!).

I don't get this either.

---

$ which teamviewer
/usr/bin/teamviewer

$ file /usr/bin/teamviewer
/usr/bin/teamviewer: symbolic link to /opt/teamviewer/tv_bin/script/teamviewer

$ file /opt/teamviewer/tv_bin/script/teamviewer 
/opt/teamviewer/tv_bin/script/teamviewer: Bourne-Again shell script, ASCII text executable

$ cat /opt/teamviewer/tv_bin/script/teamviewer
#!/bin/bash

# If you see this message, you probably attempted to start TeamViewer.
# Please open a terminal (Konsole, gnome-terminal, xterm),
# navigate to this folder (type 'cd /path/to/teamviewer' [Enter])
# then execute TeamViewer (type './teamviewer' [Enter])


TV_SCRIPT_DIR="$(dirname "$(readlink -e "$0")")"
source "$TV_SCRIPT_DIR/tvw_main"

Main "$@"

EDIT2:

For instance on AskUbuntu, as suggested in comments:

Why is sudoers NOPASSWD option not working?

and on many other places, there is a solution where they put the rule after admin group rule. I've tried it, even rebooted afterwards, but it's still not working.

Answer 1

# this line I've added myself, because I felt it is needed, however user vlastimil has had sudo access all the time, added just now
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish, but it does not work
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

That first comment suggests that your user is a member of the sudo group, which is how users on Linux Mint get sudo access by default. And the sudo group's rule comes later:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

The last matching rule wins. It doesn't matter that vlastimil has a NOPASSWD rule earlier on when this later rule also applies. The NOPASSWD rule should come after this one. That is why using a file in /etc/sudoers.d works, because these files are included last of all:

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

If you are going to add multiple files to sudoers.d, use a numbered filename convention (XX-somefile), so that you can order them reliably and ensure proper precedence of rules.

Answer 2

One solution on Linux Mint 18.2 which is based on Ubuntu 16.04 is creating a separate sudoers file using visudo, for example:

sudo visudo -f /etc/sudoers.d/teamviewer

and putting the extra line:

vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

into it. It may very well be also the most elegant solution, but that is a matter of opinion.

Answer 3

It’s the absolute path defined for the teamviewer binary.

Why not try the following as the vlastimil user

$ sudo /usr/bin/teamviewer