Shutdown script permissions?

JerichoKru · 2010-09-15 21:21:13

I think this would be the right section.

I happen to use PekWM and it doesn't have a native shutdown dialog, so I found this posted on some site that I cannot currently recall (I edited it a bit).

#!/bin/bash

gxmessage "Are you sure you want to shut down your computer?" -center -title "Take action" -font "Droid Sans bold 10" -default "Cancel" -buttons "_Cancel":1,"_Log out":2,"_Reboot":3,"_Shut down":4 >/dev/null 

case $? in
    1)
        echo "Exit";;
    2)
        init 3;;
    3)
        shutdown -r now;;
    4)
        shutdown -h now;;
esac

However, this script only works correctly if I run it as root. Currently, I use

Entry = "Exit" { Actions = "Exec gksudo ~/.shutdown.sh &" }

in my pekwm menu config to bring it up. My question is, what would I have to do to get this to run without having to enter my password (like a typical shutdown in a DE)? If at all possible.

skanky · 2010-09-15 21:38:10

If you are using sudo, you can change sudoers (see visudo) to accept the shutdown command (you can go to the detail of parameters specified) without needing to add your password. You will still need to use sudo, but that can be added to your script.

For instance these two lines exist in my sudoers file:

Cmnd_Alias SHUTDOWN=/sbin/shutdown -h now, /sbin/shutdown -r now, /sbin/reboot

skanky  ALL=(ALL) NOPASSWD: SHUTDOWN

You can also use wildcards - see man sudoers.

ewaller · 2010-09-15 21:55:46

You could try SUID (man setuid)

drcouzelis · 2010-09-16 01:13:51

Oh my goodness this has been bugging me for so long. I FINALLY got this to work.

I followed what skanky said to do. Again. I've tried to get this working for months.

It turns out it wouldn't work because I had uncommented this near the bottom of the visudo file:

%wheel ALL=(ALL) ALL

It cancels out my commands above it. >_O I comment that line back out, and I was finally able to "sudo /sbin/reboot" without typing in a password.

Yeesh.

ewaller · 2010-09-16 02:07:11

One more thing you should check. Who owns the file and who can change the file? Don't tell sudo to allow someone to run a script as root unless that file is locked down such that normal users cannot change it. Otherwise, anyone can change the script to do what ever they want, then execute it as root.

codycarey · 2010-09-16 02:12:51

skanky wrote:

Cmnd_Alias SHUTDOWN=/sbin/shutdown -h now, /sbin/shutdown -r now, /sbin/reboot

skanky  ALL=(ALL) NOPASSWD: SHUTDOWN

You can also use wildcards - see man sudoers.

Why not just specify /sbin/shutdown? I suppose there are some flags like '-n' you might not want people toying with.

Last edited by codycarey (2010-09-16 02:16:12)

skanky · 2010-09-16 09:28:41

drcouzelis wrote:

Oh my goodness this has been bugging me for so long. I FINALLY got this to work.
I followed what skanky said to do. Again. I've tried to get this working for months.
It turns out it wouldn't work because I had uncommented this near the bottom of the visudo file:
%wheel ALL=(ALL) ALL
It cancels out my commands above it. >_O I comment that line back out, and I was finally able to "sudo /sbin/reboot" without typing in a password.
Yeesh.

I fell for that too. It's obvious if you think of it - general first, specific later.

skanky · 2010-09-16 09:30:18

codycarey wrote:

skanky wrote:
Cmnd_Alias SHUTDOWN=/sbin/shutdown -h now, /sbin/shutdown -r now, /sbin/reboot

skanky  ALL=(ALL) NOPASSWD: SHUTDOWN
You can also use wildcards - see man sudoers.
Why not just specify /sbin/shutdown? I suppose there are some flags like '-n' you might not want people toying with.

Like you suggested, I like to keep stuff like this explicit - for a number of reasons.

quigybo · 2010-09-16 14:37:39

As an alternative to sudo, you can also use console kit to reboot or shut down as a normal user:

dbus-send --system --print-reply \
    --dest=org.freedesktop.ConsoleKit \
    /org/freedesktop/ConsoleKit/Manager \
    org.freedesktop.ConsoleKit.Manager.Restart

dbus-send --system --print-reply \
    --dest=org.freedesktop.ConsoleKit \
    /org/freedesktop/ConsoleKit/Manager \
    org.freedesktop.ConsoleKit.Manager.Stop

JerichoKru · 2010-09-16 16:14:05

quigybo wrote:

As an alternative to sudo, you can also use console kit to reboot or shut down as a normal user:

dbus-send --system --print-reply \
    --dest=org.freedesktop.ConsoleKit \
    /org/freedesktop/ConsoleKit/Manager \
    org.freedesktop.ConsoleKit.Manager.Restart

dbus-send --system --print-reply \
    --dest=org.freedesktop.ConsoleKit \
    /org/freedesktop/ConsoleKit/Manager \
    org.freedesktop.ConsoleKit.Manager.Stop

Thanks, this is pretty much what I was looking for.

However, what about my log out option? That won't work...

guriinii · 2010-10-09 19:53:49

@skanky how would I implement this:

Cmnd_Alias SHUTDOWN=/sbin/shutdown -h now, /sbin/shutdown -r now, /sbin/reboot

skanky  ALL=(ALL) NOPASSWD: SHUTDOWN

Would I, for example, be able to add

sudo shutdown -h now

into my openbox menu.xml?

I have attempted this to no avail.

skunktrader · 2010-10-09 20:44:10

did you try changing "skanky" to your userid?

guriinii · 2010-10-09 20:56:37

Yes. I've created scripts to shutdown and reboot. They work in terminal but require a password and do not work in my openbox menu.

Could I add '/path/to/script.sh' to the 'Cmnd_Alias' line to rectify this?

skunktrader · 2010-10-09 21:02:36

skanky wrote:

Cmnd_Alias SHUTDOWN=/sbin/shutdown -h now, /sbin/shutdown -r now, /sbin/reboot

skanky  ALL=(ALL) NOPASSWD: SHUTDOWN

Did you run visudo and add the two lines to your sudoers file, remembering to change skanky to your userid?
http://wiki.archlinux.org/index.php/Sudo#Configuration

guriinii · 2010-10-09 22:39:47

Yes I used visudo.
I've found and am using 'shutdown-dialog' from aur but I cannot get permission. It still asks for a password.

skanky · 2010-10-10 19:53:27

You may want to check the shutdown-dialog docs and/or code to see exactly what it issues - and whether it runs as a different user account.
Otherwise I've no idea.

guriinii · 2010-10-10 21:30:36

After reviewing at 'shutdown-dialog.py', although I have no experience with python, upon clicking restart/shutdown it calls '/sbin/shutdown -h now' and '/sbin/shutdown -r now'. In the sudoers file I have permission.
I don't know how to check what user it runs as.

skanky · 2010-10-11 14:25:12

If it's this one: http://aur.archlinux.org/packages.php?ID=21001
Then that's patched to use gksu (or su) to run the command, instead of gksudo (or sudo). By the name of the patch, I assume this is because there's a bug in gksudo?

For you earlier question about running it from OpenBox, I've never used that so can't help there, sorry.
There is though another way of shutting down, using quigybo's command above (again, I've never tried it).

guriinii · 2010-10-11 14:57:37

That worked! I should of tried that before installing stuff I don't need. Thank you.

ortusdei · 2010-11-02 12:14:26

ewaller wrote:

You could try SUID (man setuid)

# chmod u+s shutdown

Arch Linux

#1 2010-09-15 21:21:13

Shutdown script permissions?

#2 2010-09-15 21:38:10

Re: Shutdown script permissions?

#3 2010-09-15 21:55:46

Re: Shutdown script permissions?

#4 2010-09-16 01:13:51

Re: Shutdown script permissions?

#5 2010-09-16 02:07:11

Re: Shutdown script permissions?

#6 2010-09-16 02:12:51

Re: Shutdown script permissions?

#7 2010-09-16 09:28:41

Re: Shutdown script permissions?

#8 2010-09-16 09:30:18

Re: Shutdown script permissions?

#9 2010-09-16 14:37:39

Re: Shutdown script permissions?

#10 2010-09-16 16:14:05

Re: Shutdown script permissions?

#11 2010-10-09 19:53:49

Re: Shutdown script permissions?

#12 2010-10-09 20:44:10

Re: Shutdown script permissions?

#13 2010-10-09 20:56:37

Re: Shutdown script permissions?

#14 2010-10-09 21:02:36

Re: Shutdown script permissions?

#15 2010-10-09 22:39:47

Re: Shutdown script permissions?

#16 2010-10-10 19:53:27

Re: Shutdown script permissions?

#17 2010-10-10 21:30:36

Re: Shutdown script permissions?

#18 2010-10-11 14:25:12

Re: Shutdown script permissions?

#19 2010-10-11 14:57:37

Re: Shutdown script permissions?

#20 2010-11-02 12:14:26

Re: Shutdown script permissions?

Board footer