2

I don't like typing the password for sudo so I disabled it with

%sudo ALL=(ALL) NOPASSWD: ALL

Now I have a bad side effect that any shell script I run can silently execute sudo on my behalf.

The most typical use case would be intending to install experimental stuff to ${HOME}/local and forgetting to configure the PREFIX.

Question - is there an out-of-the-box way with sudo to block non-interactive invocation (from a script)? On Arch Linux, to be specific.

1

In addition to Gilles' answer to the Can I block non-interactive sudo invocation? aspect of your question, I would suggest a work-around for this particular element of your situation:

I don't like typing the password for sudo so I disabled it

and

Now I have a bad side effect that any shell script I run can silently execute sudo on my behalf.

If your situation is that you normally sudo a bunch of various commands, but then you find yourself executing scripts that silently execute sudo to where you aren't prompted for a password to realize that root-level things are happening, you could:

  1. Take the NOPASSWD option back out
  2. Extend the timestamp timeout beyond the stock 5 minutes to be a longer period of time
  3. Kill the sudo timestamp before running an untrusted script

You already know how to edit sudoers for the NOPASSWD option.

To extend the timestamp_timeout in the sudoers file, set it to either a really high value or a negative value. Relevant snippets from the manual page for that parameter:

timestamp_timeout

Number of minutes that can elapse before sudo will ask for a passwd again.

The default is 5.

If set to a value less than 0 the user's time stamp will not expire until the system is rebooted.

When you find yourself about to execute a script that you're not sure of, simply run sudo -k to "kill" the timestamp:

-k

When used without a command, invalidates the user's cached credentials. In other words, the next time sudo is run a password will be required.

If you run a script and find yourself being prompted by sudo for your password, you'll know that sudo was invoked and would be able to interrupt the script if you wanted.

As an aside here, I recommend setting the passprompt parameter to include the text sudo in it, such as:

Defaults passprompt="[sudo] password for %u:"

... so that it's obvious if/when sudo is prompting for your password (versus any other tool).

6

You can't do what you want because “scripted sudo” and “interactive sudo” are not contradictory. A script can run sudo in a terminal. Some examples of tools that can run a command in a terminal in a fully automated fashion are script, expect, screen, tmux, etc.

Even if sudo could somehow detect that you ran it “directly” (which is not the case since you're interacting with peripherals such as a keyboard and mouse, not with processes), it wouldn't protect you against rogue scripts. Rogue scripts could plant fake commands on your account, for example, such that the next time you run sudo it would invoke some wrapper that discretely piggybacks on your access.

And anyway the threat you're protecting is not particularly relevant.

Authorization "Before you say anything, no, I know not to leave my computer sitting out logged in to all my accounts. I have it set up so after a few minutes of inactivity it automatically switches to my brother's."

If you don't trust some software not to do problematic things such as stealing your social media account, don't run it on your account. Run it at the very least on a different account (that isn't a sudoer, of course), with no GUI access. For better isolation, run it in a virtual machine. (This still isn't perfect, it's safe against ordinary malware, not necessarily if a government targets you.)

  • The primary concern is not security, but rather a potential mechanical damage from overwriting important stuff in /usr/lib with outdated/incompatible versions (libstdc++ or libc as extreme examples). XKCD is awesome though :-) – bobah May 11 '18 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.