apt autoremove and autoclean without root

Question

Is it possible to run apt housekeeping commands (apt-get autoremove, apt-get autoclean) without root user, by granting permission of executing apt/apt-get to a user instead.

It seems that you have to use root/sudo to execute those commands, otherwise it would fail:

$ sudo cat /etc/sudoers
...
%sudo   ALL=(ALL:ALL) ALL
%wheel ALL=(ALL) NOPASSWD: ALL
user  ALL=(ALL:ALL) ALL
user  ALL= (ALL) NOPASSWD: /usr/bin/apt-get 

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d
user  ALL=(ALL) NOPASSWD: ALL

$ /usr/bin/apt-get autoremove
E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?

 

Answer 1

Yes, most apt-get commands need to be run as root, including autoremove and autoclean. With your configuration, that means

sudo apt-get autoremove

Note that allowing users to run any apt-get command as root is effectively the same as giving them full root access. (The user can prepare a package and install it; the package can contain anything the user wants, including a root-suid shell. Another option is to arrange for dpkg to encounter a configuration file conflict, in which case it can be asked to open a root shell.) To avoid this risk, you should fully specify the commands in sudoers:

user  ALL= (ALL) NOPASSWD: /usr/bin/apt-get autoremove
user  ALL= (ALL) NOPASSWD: /usr/bin/apt-get autoclean

At least for autoclean, you may find it useful to set up a cron job instead.