4

I want to give a group permission to install software without needing to input a root/sudo password. I'm on Linux Mint 20.3 Cinnamon.

I have created a group called "basicsudo".

I first typed

$ which apt-get  
/usr/bin/apt-get

Then

sudo visudo

then I added the following line

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install

to /etc/sudoers.tmp

[...]
# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install
# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

I assigned the group to a user by using the Groups and Users GUI from the menu. To check this I've run

$ groupname Alice 
Alice, basicsudo

from my account.

When logged in as Alice, this is confirmed

$ groups
Alice, basicsudo

But when trying to execute the following line as Alice, I do not succeed:

$ sudo apt-get install python3-pip  
[sudo] password for Alice:           
Sorry, user Alice is not allowed to execute '/usr/bin/apt-get    install python3-pip' as root on computername.

So clearly a) I'm prompted for a password and b) I can't execute it despite entering a password.

What is the proper way to do this?

Improve this question
4
  • How did you add Alice to the groupname group? Where exactly did you add the lines you show under "I assigned the group to a user."? Commented Feb 15, 2022 at 11:23
  • Thanks. And what is the output of groups when you are logged in as Alice? Commented Feb 15, 2022 at 11:28
  • @terdon Output is the same as groupname Alice from my root account. Commented Feb 15, 2022 at 11:31
  • 1
    Note that this is trivially escalatable -- craft a .deb package that includes a setuid shell, then apt-get install ./package and you're done. Commented Oct 11 at 5:43

2 Answers 2

Reset to default
6

Change:

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install

to

%basicsudo ALL=(ALL) NOPASSWD: /usr/bin/apt-get install *

From man sudoers:

A command name is a fully qualified file name which may include shell-style wildcards... A simple file name allows the user to run the command with any arguments they wish. However, you may also specify command line arguments (in‐cluding wildcards). Alternately, you can specify "" to indicate that the command may only be run without command line arguments...

If a Cmnd has associated command line arguments, then the arguments in the Cmnd must match exactly those given by the user on the command line (or match the wildcards if there are any)...

So:

Sudoers Meaning
%basicsudo ALL= /usr/bin/apt-get "" run apt-get with no args
%basicsudo ALL= /usr/bin/apt-get run apt-get with any args
%basicsudo ALL= /usr/bin/apt-get install run apt-get install with no more args
%basicsudo ALL= /usr/bin/apt-get install * run apt-get install with more args
Improve this answer
0

I strongly advise against this.

The reason is that you'll effectively give root access to the entire system by doing that.

Here's an excerpt from GTFOBins:

Shell

It can be used to break out from restricted environments by spawning an interactive system shell.

This invokes the default pager, which is likely to be less, other functions may apply.

apt-get changelog apt
!/bin/sh

Sudo

If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.

This invokes the default pager, which is likely to be less, other functions may apply.

sudo apt-get changelog apt
!/bin/sh

For this to work the target package (e.g., sl) must not be installed.

TF=$(mktemp)
echo 'Dpkg::Pre-Invoke {"/bin/sh;false"}' > $TF
sudo apt-get install -c $TF sl

When the shell exits the update command is actually executed.
Improve this answer
2
  • 1
    True, but at the same time if you allow someone to install anything with root privileges, they can craft a package containing a setuid shell and have done. Commented Oct 11 at 6:01
  • @Shadur-don't-feed-the-AI not necessarily if it's only official Debian packages...? Commented Oct 11 at 13:59

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.