0

I'm using arch linux - i3. I have a script to run rmmod hid-multitouch && sudo modprobe hid-multitouch. I edited the hot key in i3 and set an exception to run a script without password using sudo visudo to uncomment and added the lines

%wheel ALL=(ALL) NOPASSWD: /home/hieuc/i3script/rmod_hid.sh
hieuc ALL=(ALL) NOPASSWD: /home/hieuc/i3script/rmod_hid.sh
But it seem like it is not working right know, but a few days ago it still worked for me. Here is an output of /etc/sudoers

## sudoers file.
##
## This file MUST be edited with the 'visudo' command as root.
## Failure to use 'visudo' may result in syntax or file permission errors
## that prevent sudo from running.
##
## See the sudoers man page for the details on how to write a sudoers file.
##

##
## Host alias specification
##
## Groups of machines. These may include host names (optionally with wildcards),
## IP addresses, network numbers or netgroups.
# Host_Alias    WEBSERVERS = www1, www2, www3

##
## User alias specification
##
## Groups of users.  These may consist of user names, uids, Unix groups,
## or netgroups.
# User_Alias    ADMINS = millert, dowdy, mikef

##
## Cmnd alias specification
##
## Groups of commands.  Often used to group related commands together.
# Cmnd_Alias    PROCESSES = /usr/bin/nice, /bin/kill, /usr/bin/renice, \
#               /usr/bin/pkill, /usr/bin/top
# Cmnd_Alias    REBOOT = /sbin/halt, /sbin/reboot, /sbin/poweroff

##
## Defaults specification
##
## You may wish to keep some of the following environment variables
## when running commands via sudo.
##
## Locale settings
# Defaults env_keep += "LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET"
##
## Run X applications through sudo; HOME is used to find the
## .Xauthority file.  Note that other programs use HOME to find   
## configuration files and this may lead to privilege escalation!
# Defaults env_keep += "HOME"
##
## X11 resource path settings
# Defaults env_keep += "XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH"
##
## Desktop path settings
# Defaults env_keep += "QTDIR KDEDIR"
##
## Allow sudo-run commands to inherit the callers' ConsoleKit session
# Defaults env_keep += "XDG_SESSION_COOKIE"
##
## Uncomment to enable special input methods.  Care should be taken as
## this may allow users to subvert the command being run via sudo.
# Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE QT_IM_SWITCHER"
##
## Uncomment to use a hard-coded PATH instead of the user's to find commands
# Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
##
## Uncomment to send mail if the user does not enter the correct password.
# Defaults mail_badpass
##
## Uncomment to enable logging of a command's output, except for
## sudoreplay and reboot.  Use sudoreplay to play back logged sessions.
# Defaults log_output
# Defaults!/usr/bin/sudoreplay !log_output
# Defaults!/usr/local/bin/sudoreplay !log_output
# Defaults!REBOOT !log_output

##
## Runas alias specification
##

##
## User privilege specification
##
root ALL=(ALL) ALL

## Uncomment to allow members of group wheel to execute any command
%wheel ALL=(ALL) ALL

## Same thing without a password
%wheel ALL=(ALL) NOPASSWD: /home/hieuc/i3script/rmod_hid.sh
## User
hieuc ALL=(ALL) NOPASSWD: /home/hieuc/i3script/rmod_hid.sh

## Uncomment to allow members of group sudo to execute any command
# %sudo ALL=(ALL) ALL

## Uncomment to allow any user to run sudo if they know the password
## of the user they are running the command as (root by default).
# Defaults targetpw  # Ask for the password of the target user
# ALL ALL=(ALL) ALL  # WARNING: only use this together with 'Defaults targetpw'

## Read drop-in files from /etc/sudoers.d
## (the '#' here does not indicate a comment)
#includedir /etc/sudoers.d

My script:

#! /bin/bash

sudo rmmod hid-multitouch && sudo modprobe hid-multitouch

Here is my hot key in i3 bindsym $mod+Shift+o exec $HOME/i3script/rmod_hid.sh

  • #Vlastimil Yes, I edited through visudo #Thomas I used xclip so it look different, here is my /etc/visudoers github.com/mrhieu059/archlinux/blob/master/1.txt – HieuC Sep 23 '18 at 11:13
  • I have copied the linked file to your question – ctrl-alt-delor Sep 23 '18 at 11:17
  • You don't have to give wheel specific and general access. (but this is not causing your problem) – ctrl-alt-delor Sep 23 '18 at 11:19
  • Are you running the script with sudo /home/hieuc/i3script/rmod_hid.sh or cd /home/hieuc/i3script/; sudo ./rmod_hid.sh? – ctrl-alt-delor Sep 23 '18 at 11:20
  • 2
    I think I see your problem (see my answer). You are thinking that sudoers gives a script permission to run sudo. This is not how it works. It gives a user permission to run a script with sudo. – ctrl-alt-delor Sep 23 '18 at 11:28
2

Assuming /home/hieuc/i3script/rmod_hid.sh is your script, you should be able run sudo /home/hieuc/i3script/rmod_hid.sh without needing a password. The sudo rights apply the the command specified, not to commands called from a script named in the sudo config.

Your script on the other hand won't require sudo, as it already runs as root.

#! /bin/bash
rmmod hid-multitouch && modprobe hid-multitouch

If you want to be able to call your script without sudo, you can check the user id:

#! /bin/bash
test "$(id -u)" != 0 && exec sudo /home/hieuc/i3script/rmod_hid.sh "$@"
rmmod hid-multitouch && modprobe hid-multitouch

This will call itself with sudo if it was called without sudo. The script invoked with sudo will then execute the commands in the last line as root.

  • 1
    You can use $0 to call your self. – ctrl-alt-delor Sep 23 '18 at 11:40
  • @ctrl-alt-delor I could, but the script may be in the user's PATH and called without a path, but not be in to PATH used by sudo, and therefor not found. – RalfFriedl Sep 23 '18 at 12:35
  • As it is, it is not portable. You could use $(which $0), though this is not portable across OS. – ctrl-alt-delor Sep 23 '18 at 14:40
  • It work when I run directly by cd /home/hieuc/i3script then ./rmod_hid.sh. But when I use hotkey code to run it doesn't work. :( – HieuC Sep 23 '18 at 15:04
1
hieuc ALL=(ALL) NOPASSWD: /home/hieuc/i3script/rmod_hid.sh

This line in sudoers file allows user hieuc to execute /home/hieuc/i3script/rmod_hid.sh with sudo without prompting for a password. For example:

hieuc$: sudo ~/i3script/rmod_hid.sh

As the script already is running as root, you do not need to use sudo inside the script.

Note that having an user-writeable file that can be run using sudo means that the user can run any command as root (by modifying that script).

  • 1
    While this answer is a duplicate, the last paragraph is very important. – ctrl-alt-delor Sep 23 '18 at 11:42
  • What happen if I use a hotkey to run this command? It won't let me use sudo as a prefix into script so that why I need to add the sudo inside it. – HieuC Sep 23 '18 at 12:42
  • You could test uid and run sudo inside the script, something like: if [ ! "$(id -u)" -eq 0 ]; then exec sudo "$0"; fi. – sebasth Sep 23 '18 at 13:01
  • It work when run directly cd /home/hieuc/i3script then run ./rmod_hid.sh But it doesn't work with hotkey to run through i3 – HieuC Sep 23 '18 at 15:08
1

The script that you mention in sudoers, is the script that you will run with sudo.

So if you want to do sudo /home/me/my-script, then /home/me/my-script must be mentioned in sudoers

In your case you can add modprobe hid-multitouch to sudoers


You can also write script1 to contain sudo script2

and put script 2 into sudoers.

e.g.

script1 is called by the hotkey code. It is not mentioned in suderes it contains:

#!/bin/bash
script_called_as="$0"
script_full_name="$(readlink -e "$script_called_as")"
script_dir="$(dirname "$script_full_name")"

sudo "$script_dir/«script2»"

Replace «script2» with the name of your script. Then tell sudeers about your script2 (not script1)

  • Sorry, I don't understand what you mean? I use hotkey to run this script so I added the sudo inside the script with i3wm. I mentioned it in this line: hieuc ALL=(ALL) NOPASSWD: /home/hieuc/i3script/rmod_hid.sh How to add modprobe hid-multitouch to sudoers? I don't know how to add it? Sorry for my dumb question – HieuC Sep 23 '18 at 11:33
  • I have added an example – ctrl-alt-delor Sep 23 '18 at 11:41
  • I Got you, but I still new with the script. I don't understand the code above? #!/bin/bash script_dir="$($HOME/i3script/ "$(readlink -e "0")") sudo "$script_dir/rmod_hid.sh" – HieuC Sep 23 '18 at 11:46
  • Does it right?? – HieuC Sep 23 '18 at 11:47
  • The first line says, use bash as an interpreted. The 2nd line gets the name of the script, as called e.g. ./script1. The 3rd line gets the full name, it does that by calling readlink, the $(…) means run this command, and then replace the $(…) with the output of the command. Then the 4th line says get the directory part of the full name. Now we know the name of the directory, we can find the other script, and run it (line 6). – ctrl-alt-delor Sep 23 '18 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.