2

I want to give a group permission to install software without needing to input a root/sudo password. I'm on Linux Mint 20.3 Cinnamon.

I have created a group called "basicsudo".

I first typed

$ which apt-get  
/usr/bin/apt-get

Then

sudo visudo

then I added the following line

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install

to /etc/sudoers.tmp

[...]
# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install
# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

I assigned the group to a user by using the Groups and Users GUI from the menu. To check this I've run

$ groupname Alice 
Alice, basicsudo

from my account.

When logged in as Alice, this is confirmed

$ groups
Alice, basicsudo

But when trying to execute the following line as Alice, I do not succeed:

$ sudo apt-get install python3-pip  
[sudo] password for Alice:           
Sorry, user Alice is not allowed to execute '/usr/bin/apt-get    install python3-pip' as root on computername.

So clearly a) I'm prompted for a password and b) I can't execute it despite entering a password.

What is the proper way to do this?

3
  • How did you add Alice to the groupname group? Where exactly did you add the lines you show under "I assigned the group to a user."?
    – terdon
    Feb 15, 2022 at 11:23
  • Thanks. And what is the output of groups when you are logged in as Alice?
    – terdon
    Feb 15, 2022 at 11:28
  • @terdon Output is the same as groupname Alice from my root account. Feb 15, 2022 at 11:31

1 Answer 1

4

Change:

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install

to

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install *

From man sudoers:

A command name is a fully qualified file name which may include shell-style wildcards... A simple file name allows the user to run the command with any arguments they wish. However, you may also specify command line arguments (in‐cluding wildcards). Alternately, you can specify "" to indicate that the command may only be run without command line arguments...

If a Cmnd has associated command line arguments, then the arguments in the Cmnd must match exactly those given by the user on the command line (or match the wildcards if there are any)...

So:

Sudoers Meaning
%basicsudo ALL= /usr/bin/apt-get "" run apt-get with no args
%basicsudo ALL= /usr/bin/apt-get run apt-get with any args
%basicsudo ALL= /usr/bin/apt-get install run apt-get install with no more args
%basicsudo ALL= /usr/bin/apt-get install * run apt-get install with more args

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .