Page 1 of 2 1 2
Reply
Thread Tools
Feathers McGraw's Avatar
Feathers McGraw is offline Feathers McGraw
2015-01-15 , 19:28
Posts: 654 | Thanked: 2,368 times | Joined on Jul 2014 @ UK
#1
I get a dpkg error every time i try to do an apt-get update. Something is stopping community-ssu-enabler from being configured properly...

Code:
Reading state information... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0B of additional disk space will be used.
Do you want to continue [Y/n]? y
Setting up community-ssu-enabler (0.7-4) ...
OK
OK
>>> sudoers file: syntax error, line 29 <<<
/etc/sudoers.d/everybody.sudoers changes break sudoers
dpkg: error processing community-ssu-enabler (--configure):
 subprocess post-installation script returned error exit status 1
Errors were encountered while processing:
 community-ssu-enabler
E: Sub-process /usr/bin/dpkg returned an error code (1)
That seems to suggest it's the sudoers configuration, but i haven't edited it by hand or anything. I installed rootsh and sudser, and tried to use sudser to set a pw for sudo to make it ubuntu-ish... it doesn't seem to have worked though because it stll doesn't require a pw for sudo.

Code:
~ $ sudo cat /etc/sudoers
### Automatically added by update-sudoers start ###
Defaults env_check+="HOME DISPLAY"
Defaults env_keep+="HOME DISPLAY"
Defaults env_reset
user ALL = NOPASSWD: /usr/sbin/gainroot
user ALL = NOPASSWD: /usr/sbin/mmc-mount /dev/mmcblk0 /media/mmc1
user ALL = NOPASSWD: /usr/sbin/mmc-mount /dev/mmcblk0p1 /media/mmc1
user ALL = NOPASSWD: /bin/umount /media/mmc1,/bin/umount -l /media/mmc1
user ALL = NOPASSWD: /usr/sbin/osso-usb-mass-storage-enable.sh, /usr/sbin/osso-usb-mass-storage-disable.sh
user ALL = NOPASSWD: /sbin/mkdosfs /dev/mmcblk0*, /usr/sbin/mmc-rename /dev/mmcblk0*
user ALL = NOPASSWD: /etc/init.d/af-base-apps stop , /etc/osso-af-init/gconf-daemon.sh stop
user ALL = NOPASSWD: /etc/init.d/af-base-apps start , /etc/osso-af-init/gconf-daemon.sh start
user ALL = NOPASSWD: /etc/init.d/osso-systemui restart
user ALL = NOPASSWD: /usr/sbin/gconf-clean.sh
user ALL = NOPASSWD: /usr/sbin/chroot /mnt/initfs /usr/bin/retutime *
user ALL = NOPASSWD: /sbin/insmod /mnt/initfs/lib/modules/current/g_file_storage.ko stall=0 file=/dev/mmcblk0
user ALL = NOPASSWD: /sbin/insmod /mnt/initfs/lib/modules/current/g_ether.ko
user ALL = NOPASSWD: /sbin/rmmod g_file_storage
user ALL = NOPASSWD: /sbin/rmmod g_ether
user ALL = NOPASSWD: /usr/sbin/osso-backup-restore-locale
user ALL = (install) NOPASSWD: /usr/bin/app-installer-tool
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL=(ALL) NOPASSWD: ALL
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /opt/fmms/fmms_magic
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
%users ALL = NOPASSWD: /usr/libexec/apt-worker
%users ALL = NOPASSWD: /usr/bin/hildon-application-manager-util restore-catalogues
%users ALL = NOPASSWD: /usr/bin/hildon-application-manager-util restore-catalogues2
%users ALL = NOPASSWD: /usr/bin/hildon-application-manager-util clear-user-catalogues
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /usr/bin/personalisation
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /usr/bin/hildon-input-method-configurator.bin
user ALL = NOPASSWD: /bin/touch /etc/hildon-input-method.configured
user ALL = NOPASSWD: /bin/rm /etc/hildon-input-method.configured
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /usr/bin/mafw.sh
user ALL = NOPASSWD: /usr/bin/mafw.sh
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /etc/init.d/ke-recv start
user ALL = NOPASSWD: /etc/init.d/ke-recv stop
user ALL = NOPASSWD: /etc/init.d/alarmd start
user ALL = NOPASSWD: /etc/init.d/alarmd stop
user ALL = NOPASSWD: /etc/init.d/osso-hss start
user ALL = NOPASSWD: /etc/init.d/osso-hss stop
user ALL = NOPASSWD: /usr/bin/osso-product-info
user ALL = NOPASSWD: /bin/mv -f /tmp/.opi.tmp.tmp /tmp/.opi.tmp
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /bin/umount /media/mmc2 
user ALL = NOPASSWD: /usr/sbin/osso-prepare-partition.sh *
user ALL = NOPASSWD: /sbin/mkdosfs *
user ALL = NOPASSWD: /etc/init.d/ke-recv stop
user ALL = NOPASSWD: /etc/init.d/hildon-desktop stop
user ALL = NOPASSWD: /etc/init.d/mediaplayer-daemon stop
user ALL = NOPASSWD: /etc/init.d/metalayer-crawler0 stop
user ALL = NOPASSWD: /etc/init.d/icd2 stop
user ALL = NOPASSWD: /usr/bin/killall gconfd-2
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /bin/mv -f /var/tmp/.locale.new /etc/osso-af-init/locale
user ALL = NOPASSWD: /bin/chmod 0755 /etc/osso-af-init/locale
user ALL = NOPASSWD: /bin/chown 0.0 /etc/osso-af-init/locale
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /sbin/initctl stop sscd
user ALL = NOPASSWD: /bin/touch /var/run/pin-query-done
### Automatically added by update-sudoers end ###
### Automatically added by update-sudoers start ###
user ALL = NOPASSWD: /usr/bin/tscalibrate
### Automatically added by update-sudoers end ###
user ALL = NOPASSWD: /etc/osso-backup/restore.d/always/bluez-restore.sh
Code:
~ $ cat /etc/sudoers.d/everybody.sudoers
user ALL=NOPASSWD: /usr/bin/sudser-worker
user ALL=(ALL) PASSWD:
...any ideas?

Thanks
 
peterleinchen's Avatar
peterleinchen is offline peterleinchen
2015-01-16 , 08:00
Posts: 4,086 | Thanked: 8,796 times | Joined on Aug 2010 @ Ruhrgebiet, Germany
#2
Apparently you missed the target executable(s):
user ALL = PASSWD: ALL
BUT are you sure this is a good idea?
Just comment out this line where there is this line with NOPASSWD.
__________________
SIM-Switcher, automated SIM switching with a Double (Dual) SIM adapter
--
Thank you all for voting me into the Community Council 2014-2016!

Please consider your membership / supporting Maemo e.V. and help to spread this by following/copying this link to your TMO signature:
[MC eV] Maemo Community eV membership application, http://talk.maemo.org/showthread.php?t=94257

editsignature, http://talk.maemo.org/profile.php?do=editsignature
 

The Following User Says Thank You to peterleinchen For This Useful Post:
reinob is offline reinob
2015-01-16 , 08:09
Posts: 1,797 | Thanked: 4,223 times | Joined on Feb 2011 @ Germany
#3
/etc/sudoers.d/everybody.sudoers changes break sudoers
Whether it breaks it or not is actually irrelevant, but the CSSU postinst doesn't like it for some reason. I'd suggest you remove it (the everybody.sudoers file or purge sudser and hope it cleans up when it leaves).

I cannot (at least right now) look at the cssu-enabler postint because I didn't install that package (even though I do have CSSU thumb installed).
 

The Following 2 Users Say Thank You to reinob For This Useful Post:
Feathers McGraw's Avatar
Feathers McGraw is offline Feathers McGraw
2015-01-16 , 09:26
Posts: 654 | Thanked: 2,368 times | Joined on Jul 2014 @ UK
#4
Thanks guys. Can i ask how you have configured root access on your devices? I don't like the idea of root access withougt a pw.

EDIT: purging sudser removed that file.
Last edited by Feathers McGraw; 2015-01-16 at 09:31. Reason: added info
 

The Following 2 Users Say Thank You to Feathers McGraw For This Useful Post:
reinob is offline reinob
2015-01-16 , 10:16
Posts: 1,797 | Thanked: 4,223 times | Joined on Feb 2011 @ Germany
#5
Originally Posted by Feathers McGraw View Post
I don't like the idea of root access withougt a pw.
I do , I know it does feel weird, but after all we're talking about a device you carry in your pocket and would defend with your life , so I just type "root" and do what I have to do.

Note that you cannot use "su" because it's not suid, and you cannot make su suid because su is actually a link to busybox and *you don't want to make busybox suid*.

BTW you have "user ALL=(ALL) NOPASSWD: ALL" in your /etc/sudoers immediately after the last line coming from 01sudo. Would you mind showing a listing of your /etc/sudoers.d/*

That line (which I don't have) conflicts with "user ALL=(ALL) PASSWD:" (which as peterleinchen said should be "user ALL=(ALL) PASSWORD: ALL" but I don't speak sudoer!

I just looked in "update-sudoers" and it used "visudo -c" to check the file (this is what caused dpkg to fail in your case). So I'd suggest you run, manually, "update-sudoers" and see what it spits.
 

The Following 2 Users Say Thank You to reinob For This Useful Post:
peterleinchen's Avatar
peterleinchen is offline peterleinchen
2015-01-16 , 13:28
Posts: 4,086 | Thanked: 8,796 times | Joined on Aug 2010 @ Ruhrgebiet, Germany
#6
Changes in 01sudo:
Defaults env_check+="HOME DISPLAY"
Defaults env_keep+="HOME DISPLAY"
Defaults env_reset
#
Defaults insults
Defaults targetpw
#
#user ALL = NOPASSWD: /usr/sbin/gainroot
user ALL = PASSWD: /usr/sbin/gainroot
#user ALL = NOPASSWD: ALL
it will request root password and allow only to become root (no other program to be "sudoed", ofc there are some exceptions and you may add more, even ALL).

@reinob
To the life definitely not. But in principle you are right.
Had it 2 years your way and now 2-3 years my way
__________________
SIM-Switcher, automated SIM switching with a Double (Dual) SIM adapter
--
Thank you all for voting me into the Community Council 2014-2016!

Please consider your membership / supporting Maemo e.V. and help to spread this by following/copying this link to your TMO signature:
[MC eV] Maemo Community eV membership application, http://talk.maemo.org/showthread.php?t=94257

editsignature, http://talk.maemo.org/profile.php?do=editsignature
 

The Following 3 Users Say Thank You to peterleinchen For This Useful Post:
Feathers McGraw's Avatar
Feathers McGraw is offline Feathers McGraw
2015-01-16 , 14:07
Posts: 654 | Thanked: 2,368 times | Joined on Jul 2014 @ UK
#7
So i reinstalled sudser to see what would happen, it installed successfully and said to run sudser if i wanted to set a pw. I exited the root shell and ran the command, here's the output:

Code:
~ $ sudser
Please enter a password for 'user',
or press 'Enter' to use no password
Enter password: 
Again password: 
grep: /etc/shells: No such file or directory
Password changed.
>>> sudoers file: syntax error, line 29 <<<
/etc/sudoers.d/everybody.sudoers changes break sudoers
~ $
so is the line that conflicts with the config generated by sudser generated by rootsh?

here's my list of additional sudoers config files:

Code:
~ $ ls /etc/sudoers.d
01sudo
community-ssu.sudoers
everybody.sudoers
fmms_magic.sudoers
hildon-application-manager.sudoers
hildon-control-panel-personalisation.sudoers
hildon-input-method-configurator.sudoers
mafw-dbus-daemon.sudoers
osso-af-startup.sudoers
osso-app-killer.sudoers
osso-applet-languageregional.sudoers
ssc-daemon.sudoers
tscalibrate.sudoers
~ $
I understand why it's convenient to have easy root for everyone, but doesn't that make it trivial to root the device from everyday vulnerabilities? Not so worried about physical security because like you said i keep a close eye on my phone.

Thanks for your help. The N900 is fun!
 

The Following User Says Thank You to Feathers McGraw For This Useful Post:
reinob is offline reinob
2015-01-16 , 15:19
Posts: 1,797 | Thanked: 4,223 times | Joined on Feb 2011 @ Germany
#8
Originally Posted by Feathers McGraw View Post
Code:
~ $ sudser
Please enter a password for 'user',
or press 'Enter' to use no password
Enter password: 
Again password: 
grep: /etc/shells: No such file or directory
Password changed.
>>> sudoers file: syntax error, line 29 <<<
/etc/sudoers.d/everybody.sudoers changes break sudoers
~ $
so is the line that conflicts with the config generated by sudser generated by rootsh?
I downloaded sudser (without installing it) and had a look at the sudser-worker script, which tries to add a line like:
Code:
user ALL=(ALL) PASSWD: $shells
where $shells is a comma-separated list of the commands (shells) found in /etc/shells.
Problem is that (1) doesn't quite make sense, and (2) you don't have that file.

I happen to have that file because screen and tmux put themselves there. Normally /bin/sh should be there (you can add it there).

In any case this tells us that:
(1) sudser is buggy and unsupported
(2) you have to fix this yourself
(3) the sudo-situation in Maemo is horrible, only on-par with the dependency hell we have.

If Maemo didn't brick whenever you *think* about modifying a critical file I would propose replacing "update-sudoers" by a dummy and keeping a user-controlled list that nobody can update.

As we have it now (answering your security concern) every "app" can (1) do rm -rf / on postinst before you can say "huh?" and (2) add a file to /etc/sudoers.d to give itself root rights (many apps do this, and it doesn't seem to be considered unpolite by the people here

I think there's been already at least one thread or sub-thread dealing (= talking about, not solving) with the sudo issue. This is our own version of the "elephant in the room", but we just love our elephant the way it is.

So not only do you have to keep the N900 close to your heart, but you also have to be (100-N)% sure and N% naively-trusting about what you install.
 

The Following 2 Users Say Thank You to reinob For This Useful Post:
peterleinchen's Avatar
peterleinchen is offline peterleinchen
2015-01-16 , 15:55
Posts: 4,086 | Thanked: 8,796 times | Joined on Aug 2010 @ Ruhrgebiet, Germany
#9
I have /etc/shells, too.
Content:
/bin/sh
/bin/bash4

Still stock Maemo, so maybe cssu removed it?

Nevertheless remove suder, it is not needed.
rootsh is enough
run passwd (maybe package passwd is needed or bb-power is enough) after getting root (sudo gainroot), set a pass for root, take my changes above and you are good to go ...
__________________
SIM-Switcher, automated SIM switching with a Double (Dual) SIM adapter
--
Thank you all for voting me into the Community Council 2014-2016!

Please consider your membership / supporting Maemo e.V. and help to spread this by following/copying this link to your TMO signature:
[MC eV] Maemo Community eV membership application, http://talk.maemo.org/showthread.php?t=94257

editsignature, http://talk.maemo.org/profile.php?do=editsignature
 

The Following User Says Thank You to peterleinchen For This Useful Post:
Feathers McGraw's Avatar
Feathers McGraw is offline Feathers McGraw
2015-01-16 , 19:14
Posts: 654 | Thanked: 2,368 times | Joined on Jul 2014 @ UK
#10
Thanks guys, i think i'll go for the "set a root pw and remove sudser" method. It'll take a while to kill the "sudo" reflex!

Note that you cannot use "su" because it's not suid, and you cannot make su suid because su is actually a link to busybox and *you don't want to make busybox suid*.
reinob, do you think you could expand on this a bit - it sounds interesting. I've never looked into suid and sudo etc. on ubuntu in any great detail, but i'd like to understand the different configurations if i can. If we installed a full (non-busybox) version of su on maemo and made it suid, could that work?
 

The Following 2 Users Say Thank You to Feathers McGraw For This Useful Post:
Reply
Page 1 of 2 1 2

Tags
community ssu, dpkg error, rootsh, sudors, sudser

« Previous Thread | Next Thread »
Thread Tools

 
Forum Jump


All times are GMT. The time now is 23:26.

Contact Us - Home - Archive - Top