2

Help me debug this. I am being prompted for a password when I prefix commands with sudo despite the correct settings (I believe).

  1. I am in group wheel.

    $ groups
    network power users storage lp input audio wheel dilawars
    
  2. I have uncommented the right line using visudo:

    ##
    ## User privilege specification
    ##
    root ALL=(ALL) ALL
    
    ## Uncomment to allow members of group wheel to execute any command
    # %wheel ALL=(ALL) ALL
    
    ## Same thing without a password
    %wheel ALL=(ALL) NOPASSWD: ALL
    

I've logged out and logged in multiple times, but whenever I say sudo cmd, I am prompted for a password.

I am on Majaro Linux.

I noticed the following line in the output from strace sudo ls:

write(2, "effective uid is not 0, is /usr/"..., 133effective uid is not
 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or
 an NFS file system without root privileges?) = 133
5
  • What exact command(s) are you running? If it's something like ls, where are you using it? Commented May 16, 2021 at 1:47
  • 1
    The exact command is sudo p0f -d but to test the sudo, I also did sudo ls /var/log etc.
    – Dilawar
    Commented May 16, 2021 at 1:56
  • It would really help to see the whole /etc/sudoers. That seems to be just a snippet. Commented May 16, 2021 at 3:49
  • 2
    strace sudo ls is not useful for this case: strace (from normal user) prevents sudo to be suid-root (see man execve.2).
    – A.B
    Commented May 16, 2021 at 8:23
  • @EduardoTrápani Finally resolved it. I should have posted the full file, the issue was in the last line which reads file from /etc/sudoer.d directory. One of the file in this directory was resetting the wheel group rule.
    – Dilawar
    Commented May 16, 2021 at 16:45

2 Answers 2

6

Probably the user matches more than one rule. In that case the last matching rule wins. So, if you move:

%wheel ALL=(ALL) NOPASSWD: ALL

to the end of the file, it should work.

2
  • Another thing to consider is if the user is included in anything in /etc/sudoers.d. Commented May 16, 2021 at 10:24
  • 2
    Thanks. This was it. The line at the end of /etc/sudoers, @includedir /etc/sudoer.d was the culprit. /etc/sudoer.d has two files, one of them was using the different rule for the wheel group. I made changed in that file and it worked. Ideally, manjaro should remove the line from /etc/sudoers and point to the directory.
    – Dilawar
    Commented May 16, 2021 at 16:42
0

Aurman executes sudo -v to force user's credentials to be cached once at startup. With this option sudo by default doesn't ask password only if all matched entries have NOPASSWD tag. Thus, if in /etc/sudoers you have something like this:

%sudo   ALL=(ALL:ALL) ALL
%wheel ALL=(ALL:ALL) NOPASSWD: ALL

and you are member of both groups wheel and sudo, you are asked for password anyway. You can configure sudo to avoid asking for password if at least one matched entry has NOPASSWD tag. In /etc/sudoers:

Defaults verifypw = any

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .