Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #195676 > unrolled thread

Running GParted and Synaptic without entering password

Back to article view | Back to linux.debian.user

Contents

  Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-13 15:40 +0200
    Re: Running GParted and Synaptic without entering password "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2018-05-13 16:20 +0200
      Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-13 21:50 +0200
        Re: Running GParted and Synaptic without entering password Joe <joe@jretrading.com> - 2018-05-14 10:00 +0200
          Re: Running GParted and Synaptic without entering password <tomas@tuxteam.de> - 2018-05-14 10:50 +0200
          Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-14 15:10 +0200
            Re: Running GParted and Synaptic without entering password David Wright <deblis@lionunicorn.co.uk> - 2018-05-15 02:50 +0200
              Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-15 13:30 +0200
                Re: Running GParted and Synaptic without entering password Curt <curty@free.fr> - 2018-05-15 14:50 +0200
                  Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-15 16:10 +0200
                Re: Running GParted and Synaptic without entering password David Wright <deblis@lionunicorn.co.uk> - 2018-05-15 19:00 +0200
                  Re: Running GParted and Synaptic without entering password Glenn English <ghe2001@gmail.com> - 2018-05-15 20:30 +0200
                    Re: Running GParted and Synaptic without entering password Joe <joe@jretrading.com> - 2018-05-16 11:30 +0200
          Re: Running GParted and Synaptic without entering password "John Crawley (johnraff)" <john@bunsenlabs.org> - 2018-05-15 07:50 +0200
            Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-15 15:30 +0200
              Re: Running GParted and Synaptic without entering password John Crawley <john@bunsenlabs.org> - 2018-05-16 07:40 +0200
                Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-16 09:50 +0200
    Re: Running GParted and Synaptic without entering password <tomas@tuxteam.de> - 2018-05-13 16:20 +0200
      Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-13 21:50 +0200
        Re: Running GParted and Synaptic without entering password David Wright <deblis@lionunicorn.co.uk> - 2018-05-14 03:30 +0200
        Re: Running GParted and Synaptic without entering password Richard Hector <richard@walnut.gen.nz> - 2018-05-14 08:00 +0200
          Re: Running GParted and Synaptic without entering password <tomas@tuxteam.de> - 2018-05-14 09:00 +0200
    Re: Running GParted and Synaptic without entering password bw <bwtnguy@yahoo.com> - 2018-05-13 16:30 +0200
      Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-13 22:00 +0200
        Re: Running GParted and Synaptic without entering password bw <bwtnguy@yahoo.com> - 2018-05-13 22:20 +0200
        Re: Running GParted and Synaptic without entering password <tomas@tuxteam.de> - 2018-05-14 09:20 +0200
          Re: Running GParted and Synaptic without entering password Richard Owlett <rowlett@cloud85.net> - 2018-05-14 15:40 +0200
    Re: Running GParted and Synaptic without entering password Brian <ad44@cityscape.co.uk> - 2018-05-14 01:10 +0200

Page 2 of 2 — ← Prev page 1 [2]

#195695

[Multipart message — attachments visible in raw view] — view raw

On 14/05/18 07:44, Richard Owlett wrote:
> On 05/13/2018 09:09 AM, tomas@tuxteam.de wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On Sun, May 13, 2018 at 08:18:26AM -0500, Richard Owlett wrote:
>>> The underlying problem is not understanding what I read concerning
>>> sudo &/or /etc/sudoers (*INCLUDING* man pages).
>>>
>>> Only *ONE* individual has physical access to my _personal_ machine.
>>> Therefore, any distinction between 'richard' and 'root' is
>>> inherently artificial.
>>
>> Not so fast. A small flaw in your browser might allow it to run as
>> you and try some shenanigan as root: you'd notice it by "something"
>> asking for your credentials unexpectedly...
> 
> You have moths in your logic (cf.
> https://en.wikipedia.org/wiki/Grace_Hopper):
>   Moth, the first:
>       When asked for unexpected permission, "Just say NO"
>       [If doubtful, then dirty ;]

If you don't require a password, it won't need to ask permission, will
it? So you don't notice.

>   Moth, the second:
>       What if I had been logged in as root?

Running a browser as root? Same as above, but worse.

Richard

[toc] | [prev] | [next] | [standalone]

#195697

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, May 14, 2018 at 05:52:55PM +1200, Richard Hector wrote:

[...]

> Running a browser as root? Same as above, but worse.

Well, the cryptocurrency miner might have the chance to run
faster then ;-)

Cheers
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlr5M8UACgkQBcgs9XrR2kaPewCfeqHgukij9H8etBrj7IQ6OohK
1WcAnjaSA5X3h9S2SMq95iJffyp4p39V
=rWDe
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#195680

On Sun, 13 May 2018, Richard Owlett wrote:

> <snip> 
> The result I wish to achieve is to click on the icon for either GParted or
> Synaptic *WITHOUT* being asked for a password (either root's or user's).
> 
> I've found vague hints that adding a line to my local /etc/sudoers file
> such as
>   richard     ALL = /usr/sbin/gparted , /usr/sbin/synaptic
> would accomplish my goal.
> Is that correct?
><snip>

I think that might work if clicking each icon actually runs those 
commands from each .desktop file.  Maybe you should look in them and 
check?  Try looking for gparted.desktop and synaptic.desktop in 
/usr/share/applications 

I don't think they really run as root, but could be wrong.  You can adjust 
policykit if they are using some pkexec commands instead.  I think editing 
pk is a better idea than running gui apps as root, or with sudo.

[toc] | [prev] | [next] | [standalone]

#195687

On 05/13/2018 09:26 AM, bw wrote:
> 
> 
> On Sun, 13 May 2018, Richard Owlett wrote:
> 
>> <snip>
>> The result I wish to achieve is to click on the icon for either GParted or
>> Synaptic *WITHOUT* being asked for a password (either root's or user's).
>>
>> I've found vague hints that adding a line to my local /etc/sudoers file
>> such as
>>    richard     ALL = /usr/sbin/gparted , /usr/sbin/synaptic
>> would accomplish my goal.
>> Is that correct?
>> <snip>
> 
> I think that might work if clicking each icon actually runs those
> commands from each .desktop file.

I believe it does:
   1. if logged in as root, entering "/use/sbin/gparted" runs.
   2. if *NOT* logged in as root, entering "/usr/sbin/gparted" asks for 
password.

[toc] | [prev] | [next] | [standalone]

#195688

On Sun, 13 May 2018, Richard Owlett wrote:

> On 05/13/2018 09:26 AM, bw wrote:
> > 
> > 
> > On Sun, 13 May 2018, Richard Owlett wrote:
> > 
> > > <snip>
> > > The result I wish to achieve is to click on the icon for either GParted or
> > > Synaptic *WITHOUT* being asked for a password (either root's or user's).
> > > 
> > > I've found vague hints that adding a line to my local /etc/sudoers file
> > > such as
> > >    richard     ALL = /usr/sbin/gparted , /usr/sbin/synaptic
> > > would accomplish my goal.
> > > Is that correct?
> > > <snip>
> > 
> > I think that might work if clicking each icon actually runs those
> > commands from each .desktop file.
> 
> I believe it does:
>   1. if logged in as root, entering "/use/sbin/gparted" runs.
>   2. if *NOT* logged in as root, entering "/usr/sbin/gparted" asks for
> password.
> 

Yeah, but I thought you wanted to click an icon?  What command does that 
execute?  There may already be a group setup to do it, like admin, so 
check the pk stuff out. 

[toc] | [prev] | [next] | [standalone]

#195698

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, May 13, 2018 at 02:51:49PM -0500, Richard Owlett wrote:
> On 05/13/2018 09:26 AM, bw wrote:
> >
> >
> >On Sun, 13 May 2018, Richard Owlett wrote:
> >
> >><snip>
> >>The result I wish to achieve is to click on the icon for either GParted or
> >>Synaptic *WITHOUT* being asked for a password (either root's or user's).
> >>
> >>I've found vague hints that adding a line to my local /etc/sudoers file
> >>such as
> >>   richard     ALL = /usr/sbin/gparted , /usr/sbin/synaptic
> >>would accomplish my goal.
> >>Is that correct?
> >><snip>
> >
> >I think that might work if clicking each icon actually runs those
> >commands from each .desktop file.
> 
> I believe it does:
>   1. if logged in as root, entering "/use/sbin/gparted" runs.
>   2. if *NOT* logged in as root, entering "/usr/sbin/gparted" asks
> for password.

Yes, perhaps that's what sudo is for then (you'd have to run
"sudo /usr/sbin/gparted" instead: make it more convenient by
some wrapper [1]).

Of course the recommendation is still "don't do it", but the
good thing is: it's just that, a recommendation. FWIW, I went
through that phase and am back now to my "custom commands" 
asking for a password when doing something sudo-ish. It's a
kind of "are you awake there, at the controls?" which I've
come to appreciate. But to each her own and all that :-)

Cheers

[1] There are many solutions to that: I have a /home/tomas/bin
which I add to my PATH where I put all those little scripts
which are too small or too unstable to go to /usr/local/bin.
If I need a sudo in there, I just code it in. In my default
setting, I then get asked for a password. By relaxing sudoers
(e.g. with NOPASSWD: or !authenticate) you can fine tune that
to skip the authentication at a very fine-grained level (by
command, by user or by host (on which the command is running)).

- -- tomas
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlr5Ny8ACgkQBcgs9XrR2karmQCbBqB+iZiKRFNv9yRfUciGd02D
NgkAn0Y9TFBecQaBgIA4G/T8o/1sjtwH
=NZbD
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#195720

On 05/14/2018 02:13 AM, tomas@tuxteam.de wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Sun, May 13, 2018 at 02:51:49PM -0500, Richard Owlett wrote:
>> On 05/13/2018 09:26 AM, bw wrote:
>>>
>>>
>>> On Sun, 13 May 2018, Richard Owlett wrote:
>>>
>>>> <snip>
>>>> The result I wish to achieve is to click on the icon for either GParted or
>>>> Synaptic *WITHOUT* being asked for a password (either root's or user's).
>>>>
>>>> I've found vague hints that adding a line to my local /etc/sudoers file
>>>> such as
>>>>    richard     ALL = /usr/sbin/gparted , /usr/sbin/synaptic
>>>> would accomplish my goal.
>>>> Is that correct?
>>>> <snip>
>>>
>>> I think that might work if clicking each icon actually runs those
>>> commands from each .desktop file.
>>
>> I believe it does:
>>    1. if logged in as root, entering "/use/sbin/gparted" runs.
>>    2. if *NOT* logged in as root, entering "/usr/sbin/gparted" asks
>> for password.
> 
> Yes, perhaps that's what sudo is for then (you'd have to run
> "sudo /usr/sbin/gparted" instead: make it more convenient by
> some wrapper [1]).
> 
> Of course the recommendation is still "don't do it", but the
> good thing is: it's just that, a recommendation. FWIW, I went
> through that phase and am back now to my "custom commands"
> asking for a password when doing something sudo-ish. It's a
> kind of "are you awake there, at the controls?"

That's what I want on all but one of my installs.

> which I've come to appreciate. But to each her own and all that :-)
> 
> Cheers
> 
> [1] There are many solutions to that: I have a /home/tomas/bin
> which I add to my PATH where I put all those little scripts
> which are too small or too unstable to go to /usr/local/bin.
> If I need a sudo in there, I just code it in. In my default
> setting, I then get asked for a password. By relaxing sudoers
> (e.g. with NOPASSWD: or !authenticate) you can fine tune that
> to skip the authentication at a very fine-grained level (by
> command, by user or by host (on which the command is running)).

That sounds promising. What should I be reading?

> 
> - -- tomas
>  

[toc] | [prev] | [next] | [standalone]

#195692

On Sun 13 May 2018 at 08:18:26 -0500, Richard Owlett wrote:

> The underlying problem is not understanding what I read concerning sudo &/or
> /etc/sudoers (*INCLUDING* man pages).
> 
> Only *ONE* individual has physical access to my _personal_ machine.

Not an unusual view. Generally advanced by people who have little
appreciation of what is meant by administering a system and want
things their own way. A fuse blows in their house; easily solved
with a six inch nail as a replacement.

> Therefore, any distinction between 'richard' and 'root' is inherently
> artificial.

Both users can wallow in the same pool of ignorance, then.

Accepting the proposition richard could always operate as superuser.
Problem solved. Next, please.

-- 
Brian.

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web