Running a Script as Root without Password

Hardware Librem 5
1

I have a UDEV rule set up to change the power settings on the phone depending on whether or not I’m connected to my Nexdock, basically I disable and enable the screen blanking depending on whether or not I’m connected.

I’d also like to change the brightness settings depending on this condition as well which is basically adjusting the value inside /sys/class/backlight/backlight-dsi/brightness.

I’ve tried putting in an exception in the sudoers-d directory to no avail. It continues to ask for a password. Has anyone accomplished a similar thing by having a script run as root without password prompt?

1 Like
2

I’m new to Linux but maybe, making a cron job as root?

1 Like
3

But how would I trigger it on detecting the dock through the USB port?

1 Like
4

I understand you have the script to do what you want ready.

1 Like
5

hmm…so you’re saying to make a specific non time triggered cron job? I’ve never tried that but maybe that is a way to do it.

1 Like
6

I see the problem, sorry, my mad.
Maybe have a script run as root as a cron job at boot. But make sure the script is running continuously and checking what you need to check and doing what you need doing. Like a while(ture){code} function in C.

1 Like
7

Yeah that might do it, seems a bit brute force tho to have that running all the time when I already have a way to trigger it with a UDEV rule.

I know you can specify specific scripts in sudoers to run without a password but it just doesn’t seem to work on the L5, mind you I haven’t tried it on any other linux platform either. Supposedly it should work if it’s at the bottom of the sudoers file or if you put a separate file in the sudoers-d directory it should execute those after all the other lines in the sudoers file.

I’m just wondering if there is something peculiar about the L5 that is blocking that from happening.

2 Likes
8

The udev man page I think is suggesting you use a service for this kind of thing.

Also, putting that to one side, what user does the command run as by default? Do you actually need to use sudo?

Also note from the udev man page the various restrictions on what you should (not) run as a command e.g. don’t want to be blocking / no network access etc.

2 Likes
9

It definitely used to work on the Librem 5 - because it used to default that way and I didn’t like that (for security reasons) so I changed it on my phone to require a password. It is possible that the default flipped to secure in byzantium.

Also note that there are permissions restrictions (can’t be too permissive) for files in the sudo config i.e. in order to prevent you shooting yourself in the foot. So be careful with ownership and permissions.

1 Like
10

I know it will not run without sudo and I accept the security issue. That’s why I was hoping to use the sudoers file to only allow that one scirpt to run without a password.

1 Like
11

On thé librem5 i did not achieve wirh cron except activating thé root account but i round this not secure.
So i did that with a systemd service .
Create a service “at boot” (for instance), with this script (just complete the ExecStart variable):

#!/bin/sh
serviceName=run_at_boot
sudo tee /etc/systemd/system/$serviceName.service > /dev/null <<EOT
[Unit]
Description=run_at_boot
	
[Service]
ExecStart=<YOUR_SCRIPT_IN_ABSOLUTE_PATH>

[Install]
WantedBy=multi-user.target
EOT
sudo systemctl enable $serviceName.service
sudo systemctl status $serviceName

I am also using such a service to autobackup the system at boot on my librem5

2 Likes
12

Note that it will need more than the above in order to tie the service to existence of the device (rather than just starting the service at boot).

man udev

2 Likes
13

Yeah I think that’s what people are missing. I already have the trigger for the script, all I need is a way to have it run as root without a password, and I’m prepared to accept the potential security issue of running JUST that script without password.

1 Like
14

This is just an example. You just have to adapt your service and/or ypur script like here: linux - Run script every 30 min with systemd - Unix & Linux Stack Exchange
My solution is the only one I found to run a root script without password:

  • activate (unexpire) the root account, then crontab root will work, but it is not recommended to do it like this
    Or
  • use a systemd service.

But i would be glad to know a third one …because I searched a long time to run a root script without password for a cron job. Systemd can do the same as cron and even more (note triggers possibilities)

I use this to autowakeup from suspend my librem5 every x minutes in order to get my xmpp (Dino) messages., and the same to backup /etc , /var …etc. (Which requires root without password)

Maybe udev has triggers that better fit your needs, indeed.

1 Like
15

It seems like adding the script to the sudoers file or a fille in the sudoers.d directory does not get respected. Is this something that has been depricated?

1 Like
16

Yes, but not triggered directly from udev via RUN+=... - instead indirectly via a service i.e. TAG+="systemd", ENV{SYSTEMD_WANTS}=...

Not that I am aware of - but man udev does note that the command that runs directly from udev runs in a sandbox and perhaps that is interfering with your intentions.

1 Like
17

Oh but I do…here is my rule in the /etc/udev/rules.d/90-monitor-hotplug.rules:

SUBSYSTEM=="drm", ACTION=="change", RUN+="/bin/su purism -c '/home/purism/.local/bin/monitorhotplug.sh'"

Can I add another RUN statement in here for this same rule? Actually I don’t want to make the brightness change in here because I need to use the hotplug script to evaluate whether or not the L5 is plugged into my Nexdock. Or can I just change the brightness setting with an “add” statement when connected and a “remove” when unplugged?

1 Like
18

I tried this but it does not work:

SUBSYSTEM=="drm", ACTION=="change", RUN+="/bin/su purism -c '/home/purism/.local/bin/monitorhotplug.sh'"
SUBSYSTEM=="drm", ACTION=="add", RUN+="/bin/su purism -c '/home/purism/scripts/docked_backlight.sh'"
SUBSYSTEM=="drm", ACTION=="remove", RUN+="/bin/su purism -c '/home/purism/scripts/undocked_backlight.sh'"
1 Like
19

I don’t know but I am suggesting that you remove the RUN statement - and use a service instead.

I note also that you are using su rather than sudo - and that may explain why configuring sudoers was not effective.

However there may also be complications if the script must run as user purism.

1 Like