0

I log on to my server as userA, this user has a bash shell, everything works fine with it.

Then, for the purposes of a program, I've had to do sudo adduser --system --home=/home/userB --group userB; this user is apparently passwordless, judging by the contents of /etc/passwd and /etc/shadow:

$ grep userB /etc/passwd userB:x:Z08:WW9::/home/userB:/bin/false $ sudo grep userB /etc/shadow userB:*:16XXX:0:YYYYY:7:::

Also, there is no /home/userB/.profile, nor any /home/userB/.bash* files in the userB home directory.

Now, while I'm logged in as userA, I'd like to run commands as userB, in particular inspect the $PATH that userB sees. So I've tried to edit via EDITOR=/usr/bin/nano sudo visudo, and add either of the userA lines:

... # User privilege specification root ALL=(ALL:ALL) ALL #userA ALL=(userB) NOPASSWD: /bin/bash userA ALL = (userB) NOPASSWD: ALL ...

... then save the file, logout from remote shell, re-login back as userA. Then I try running:

$ sudo -iu userB; echo $? 1 $ sudo -S -u userB -i /bin/bash -l -c 'echo $HOME'; echo $? 1 $ sudo -i -u userB echo \$HOME; echo $? 1

... and clearly, nothing works - and there is no error either. Then I thought I'd strace one of these commands, and indeed I got an error:

$ strace sudo -iu userB ... write(2, "sudo: effective uid is not 0, is"..., 140sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges? ) = 140 exit_group(1) = ? +++ exited with 1 +++

However, nosuid is not a problem on this root partition, I guess:

$ mount | grep '/ ' /dev/sdaX on / type ext4 (rw,errors=remount-ro)

So now I really have no idea what to do. Is it possible at all to have userA in this case run commands (e.g. print the $HOME environment variable) as userB - and if so, how can I get it to work?

Improve this question
11
  • 2
    A * in the password field in /etc/shadow means "no login", rather than "no password". Commented Sep 13, 2016 at 15:38
  • 2
    You can't strace setuid programs; the setuid flag is ignored if you try. Commented Sep 13, 2016 at 15:41
  • 1
    Set a password with passwd userB. Commented Sep 13, 2016 at 15:43
  • 1
    What happens if you change userB's shell to /bin/bash? Currently it is set to /bin/false. Commented Sep 13, 2016 at 15:43
  • 1
    @SatoKatsura userB does not need a password because no userB credentials are ever being asked for. * is good, here. Commented Sep 13, 2016 at 15:44

2 Answers 2

Reset to default
2

The -i option in sudo attempts to create a login shell, which in turn launches the user's chosen shell. You have set this to /bin/false in your /etc/passwd:

$ grep userB /etc/passwd userB:x:Z08:WW9::/home/userB:/bin/false

Try running:

sudo -u userB ls

If this works then it is all working as you have configured it to. If you want a interactive shell use -s instead which will not call the user's login shell.

If you want a full login shell you must change the user's shell with

sudo chsh -s /bin/bash userB
Improve this answer
1
  • Many thanks @MichaelDaffin - indeed, sudo -u userB ls even with /bin/false in /etc/passwd; great to know this! Commented Sep 13, 2016 at 16:16
1

From the sudo manpage:

-i, --login Run the shell specified by the target user's password data- base entry as a login shell.

Your userB has /bin/false as the shell, so that's the command that is run.

% /bin/false ; echo $? 1

So to fix this you need to change the shell of userB to /bin/bash (or /bin/sh or whatever you prefer) or don't use the -i flag to sudo. Do you need a login shell?

Improve this answer
1
  • Many thanks @StephenHarris - that explains it; cheers! Commented Sep 13, 2016 at 16:16

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.