3

How might I use script /usr/bin/su-to-root after I have intentionally locked the root account?

Running Debian GNU/Linux 6.0.5 "squeeze" and noticed menu item "System > Administration > Synaptic Package Manager" has default command:

su-to-root -X -c /usr/sbin/synaptic

which fails even though I provide the correct root password.

I have locked the root account (via command sudo passwd -l root) after granting my normal user sudo access via file /etc/sudoers.

Via the su-to-root man page, I tried modifying the command to use a specific user:

su-to-root -X -p "user" -c /usr/sbin/synaptic

but this did not seem to work.

In both cases, after three failed authentications, I receive message:

"Starting without administrative privileges. You will not be able to apply any changes. But you can still export the marked changes or create a download script for

Any ideas?

Traces of the script:

k@bucket:/tmp$ bash -x /tmp/su-to-root -X -c /usr/sbin/synaptic
+ test -r /etc/su-to-rootrc
+ test -r /home/k/.su-to-rootrc
+ PRIV=root
+ COMMAND=
+ NEEDS=text
++ which gettext
+ gettext=/usr/bin/gettext
+ for i in '"$@"'
+ case "$prev" in
+ prev=-X
+ for i in '"$@"'
+ case "$prev" in
+ NEEDS=X11
+ prev=-c
+ for i in '"$@"'
+ case "$prev" in
+ COMMAND=/usr/sbin/synaptic
+ prev=/usr/sbin/synaptic
+ '[' -z /usr/sbin/synaptic ']'
++ id -u
+ euid=1000
++ id -u root
+ privid=0
+ test 1000 = 0
+ case $NEEDS in
+ test -z ''
+ which gksu
+ SU_TO_ROOT_X=gksu
+ test X = Xtrue
+ case $SU_TO_ROOT_X in
+ gksu -u root /usr/sbin/synaptic
k@bucket:/tmp$ 

and

k@bucket:/tmp$ bash -x /tmp/su-to-root -X -p k -c /usr/sbin/synaptic
+ test -r /etc/su-to-rootrc
+ test -r /home/k/.su-to-rootrc
+ PRIV=root
+ COMMAND=
+ NEEDS=text
++ which gettext
+ gettext=/usr/bin/gettext
+ for i in '"$@"'
+ case "$prev" in
+ prev=-X
+ for i in '"$@"'
+ case "$prev" in
+ NEEDS=X11
+ prev=-p
+ for i in '"$@"'
+ case "$prev" in
+ PRIV=k
+ prev=k
+ for i in '"$@"'
+ case "$prev" in
+ prev=-c
+ for i in '"$@"'
+ case "$prev" in
+ COMMAND=/usr/sbin/synaptic
+ prev=/usr/sbin/synaptic
+ '[' -z /usr/sbin/synaptic ']'
++ id -u
+ euid=1000
++ id -u k
+ privid=1000
+ test 1000 = 1000
+ sh -c /usr/sbin/synaptic
k@bucket:/tmp$ 
1

Create a file named '~/.su-to-rootrc' with contents 'SU_TO_ROOT_SU="sudo"'.

Example:

echo 'SU_TO_ROOT_SU="sudo"'>~/.su-to-rootrc

Or create it system wide at /etc. su-to-root without this rc file always tries su, which does not work with blocked root accout. If you create the rc file, it uses sudo instead and everything is fine.

  • Thank you @FrankS ! – iokevins Sep 9 at 23:38
4

It seems script /usr/bin/su-to-root compares the euid of the user running su-to-root to the euid of either account root (default) or the user-specified account:

euid=$(id -u)
privid=$(id -u $PRIV)
if test "$euid" = "$privid"; then
  sh -c "$COMMAND"

If the euid's match, su-to-root skips authentication and runs command sh -c /usr/sbin/synaptic straightaway, skipping gksu/kdesu/ktsuss/sux/and so forth.

So, it seems /usr/bin/su-to-root assumes the calling user has root privileges and does not authenticate...which seems to represent a valid assumption in Debian.

As a work-around, I changed the Debian menu item command from su-to-root -X -p "user" -c /usr/sbin/synaptic to gksu -S /usr/sbin/synaptic.

From man gksu:

--sudo-mode, -S : Force gksu to use sudo(1) as its backend for running the programs.

This seems to force sudo, which represents what I want. Synaptic Package Manager authenticates, if needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.