[Solved] Sudoers rule ignored in favor of polkit

mkkot · 2018-09-23 22:24:41

I need a VPN connection activation and deactivation privilege for an unprivileged user. So I read about sudoers file on a wiki and with visudo did this:

kinia ALL=(ALL) NOPASSWD:/usr/bin/systemctl stop openvpn-client@SP52-client.service

So, user kinia should be able to run this systemctl stop command without being asked for a password.

sudo -lU kinia
User kinia may run the following commands on linux:
    (ALL) NOPASSWD: /usr/bin/systemctl stop openvpn-client@SP52-client.service

However, this rule is ignored in favor of:

/usr/share/polkit-1/actions/org.freedesktop.systemd1.policy

<action id="org.freedesktop.systemd1.manage-units">
                <description gettext-domain="systemd">Manage system services or other units</description>
                <message gettext-domain="systemd">Authentication is required to manage system services or other units.</message>
                <defaults>
                        <allow_any>auth_admin</allow_any>
                        <allow_inactive>auth_admin</allow_inactive>
                        <allow_active>auth_admin_keep</allow_active>
                </defaults>
        </action>

So, the system instead of executing my action, displays a window asking for a password of user in (I guess) adm group.

Before I reconfigure the system to use polkit for this task instead of sudoers file, please tell me why this happens? Is this "works as designed" or I'm doing something wrong here?

Last edited by mkkot (2018-09-23 22:39:43)

Slithery · 2018-09-23 22:29:56

Are you running the systemctl... commmand using sudo?

mkkot · 2018-09-23 22:36:11

Yeah, no. I just noticed this silly mistake and wanted to remove this topic, but you already answered.

Anyway, I can see it still asks for a password, this time sudo asks for it:

sudo stop openvpn-client@SP52-client.service
[sudo] password for kinia:

Slithery · 2018-09-23 22:37:47

Surely you should be running...

sudo systemctl stop openvpn-client@SP52-client.service

mkkot · 2018-09-23 22:39:17

Surely I should not be sitting till late night here as my mind seems to be off. Thanks a lot, it works all fine now!

eschwartz · 2018-09-26 01:47:31

Yeah, polkit and sudo are two completely unrelated ways of acquiring root permissions for a process... it just happens that by convention, the same users have permission for both, and sometimes, programs like systemctl can be used with either one.

Arch Linux

#1 2018-09-23 22:24:41

[Solved] Sudoers rule ignored in favor of polkit

#2 2018-09-23 22:29:56

Re: [Solved] Sudoers rule ignored in favor of polkit

#3 2018-09-23 22:36:11

Re: [Solved] Sudoers rule ignored in favor of polkit

#4 2018-09-23 22:37:47

Re: [Solved] Sudoers rule ignored in favor of polkit

#5 2018-09-23 22:39:17

Re: [Solved] Sudoers rule ignored in favor of polkit

#6 2018-09-26 01:47:31

Re: [Solved] Sudoers rule ignored in favor of polkit

Board footer