11

While setting up docker on Ubuntu 20.04 I did sudo usermod -G docker $USER. As noted in related questions here, I missed the -a flag and replaced all secondary groups. However, I didn't realize this until after I rebooted my machine. This is a single-user work station. I could fix this with root, but I don't have the password. How do I restore the proper groups without root access? The only one that causes a problem now is sudo, but I'm sure others will crop up. Can I do anything without reinstalling Ubuntu from scratch?

3
  • @A.B So does your suggestion mean creating a simple DOCKERFILE for an ubuntu container and then open a shell in that container? – Code-Guru Jun 17 at 19:59
  • 1
    "Else you can use the standard method of a rescue iso to recover root access." This is probably the real solution I'm looking for. Will you post an actual answer with a few more details? – Code-Guru Jun 17 at 20:16
  • 1
    askubuntu.com/q/70442/158442 – muru Jun 18 at 4:15
30

You still have one group left: docker. That means you still have control over the docker daemon. This daemon can run a container with the host's root filesystem mounted and then the container can edit files (vi is available in busybox) or simpler: can chroot to the host's filesystem.

Download a minimal busybox image:

myuser@myhost:~$ docker pull busybox
Using default tag: latest
latest: Pulling from library/busybox
b71f96345d44: Pull complete 
Digest: sha256:930490f97e5b921535c153e0e7110d251134cc4b72bbb8133c6a5065cc68580d
Status: Downloaded newer image for busybox:latest
docker.io/library/busybox:latest

Run a container with this image interactively and in privileged mode (in case AppArmor would block the chroot command later without it):

$ docker run -it --mount type=bind,source=/,target=/host --privileged busybox

Continue with interactive commands from the container. You can simply chroot to the mount point to "enter" the root filesystem and get all Ubuntu commands:

/ # chroot /host

Use adduser which is a simpler wrapper around useradd:

root@74fc1b7903e5:/# adduser myuser sudo
Adding user `myuser' to group `sudo' ...
Adding user myuser to group sudo
Done.
root@74fc1b7903e5:/# exit
exit
/ # exit

Either logout and relog, or change group manually:

myuser@myhost$ sg sudo

And root access is restored:

myuser@myhost$ sudo -i
[sudo] password for myuser:
root@myhost# 

Conclusion: be very prudent when allowing remote access to Docker (through port 2375/TCP). It means root access by default.

1
  • 4
    Running docker pull before docker run is not required. Docker will download the image automatically if it's missing. I think you can remove it to focus on the (awesome) solution. – A.L Jun 18 at 15:07
7

Can I do anything without reinstalling Ubuntu from scratch?

Aside from the docker-specific method given in the other answer, if you have physical access and there are not countermeasures* in place then you can nearly always get into a system if you are prepared to reboot it.

There are a couple common methods.

One is to use a livecd and mount the filesystem.

Another is to use the "init=/bin/sh" trick, when you get the grub menu select your boot option but instead of pressing enter you press "e", then you add "init=/bin/sh" to the kernel command line. This should drop you to a shell early in the boot process. The root file system is probablly still read only at this point so do mount -o remount,rw / to make it writable. You should then be able to set a root password with passwd root or add a user to the sudo group by using adduser myuser sudo. When you have finished making your edits you can then do exec init to continue the boot process as normal.

* bios/bootloader passwords would be one, some types disk encryption may be another.

1
  • Thanks for the answer. – Code-Guru Jul 6 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.