Discussion between Matt and Venem

Imported from a comment discussion on askubuntu.com/questions/...
Feb 26, 2013 19:49
Ok, all done
Feb 26, 2013 19:34
but now I will put all of this into the original answer as an alternative
Feb 26, 2013 19:34
[sorry my laptop b0rked, had to reboot]
Feb 26, 2013 19:34
[and possibly do some mischief as root] :P
Feb 26, 2013 19:33
Then a regular user may no longer edit the script at will
Feb 26, 2013 19:29
$ gksudo gedit /etc/sudoers
Now replace /hom/emil/ with /bin/
So it should be
emil ALL = NOPASSWD:/bin/battery-script.sh
Feb 26, 2013 19:28
$ sudo mv battery-script.sh /bin/
$ sudo chown root /bin/battery-script.sh
$ sudo chgrp root /bin/battery-script.sh
$ sudo chmod 555 /bin/battery-script.sh
Feb 26, 2013 19:27
do this
Feb 26, 2013 19:27
You must move battery-script.sh to /bin/
Feb 26, 2013 19:27
Ok
Feb 26, 2013 19:24
then I will give you the correct user/permissions
Feb 26, 2013 19:24
i'm still trying to make sure it's fixable
Feb 26, 2013 19:24
:)
Feb 26, 2013 19:24
yeah
Feb 26, 2013 19:23
I think...
Feb 26, 2013 19:20
Ok to fix the security hole, you need to move the script
Feb 26, 2013 19:19
Since my test file [and also yours] is in your home directory, you own the file. the problem was it kept letting me edit a "root" file
Feb 26, 2013 19:19
I figured it out
Feb 26, 2013 19:19
ohhhhhhhh
Feb 26, 2013 19:17
Then it recognizes it in sudoers, and gives it root without a password
Feb 26, 2013 19:16
sudo will work regularly for every program, /except/ when you say "sudo ./battery-script"
Feb 26, 2013 19:16
that's the only way to use sudo without password
Feb 26, 2013 19:16
yes
Feb 26, 2013 19:15
[to patch the security hole]
Feb 26, 2013 19:15
Just to get permissions/ownership settled
Feb 26, 2013 19:15
No a simple echo script
Feb 26, 2013 19:14
:S
Feb 26, 2013 19:14
but it's not working, it keeps letting my normal user edit the script
Feb 26, 2013 19:14
I'm trying to make it so a script can only be executed but not changed by normal users
Feb 26, 2013 19:13
hmm...
Feb 26, 2013 19:11
Let me make sure of the permission
Feb 26, 2013 19:11
actually.. hold on
Feb 26, 2013 19:10
sets ownership to root so you must have root to edit it, and makes it so only root can read/write/execute, every other user can only execute
Feb 26, 2013 19:09
sudo chown root battery-script.sh
sudo chmod 711 battery-script.sh
Feb 26, 2013 19:09
I would recommend this:
Feb 26, 2013 19:08
you can fix that by easily setting ownership/permissions
Feb 26, 2013 19:07
If your account has a password, or if you are the only user, I would really not worry about it
Feb 26, 2013 19:07
Because right now, a script, editable by your user, will be run as root on every boot. If someone knew about it, they could add a line, and execute their own root commands, which is pretty close to giving them root without a password [as long as you're logged in]
Feb 26, 2013 19:05
now I suppose I should mention that some people would consider this to be a security hole
Feb 26, 2013 19:04
correct
Feb 26, 2013 19:02
And also I will add this other solution to my answer
Feb 26, 2013 19:02
the xmessage line. because once you know it works you do not need it there, it would get annoying. lol
Feb 26, 2013 19:01
after the next reboot, and you get the popup text, you can go back and remove the line
Feb 26, 2013 19:01
you're welcome, glad I could help
Feb 26, 2013 19:00
you didn't know what?
Feb 26, 2013 18:59
ifconfig eth0 down
Feb 26, 2013 18:59
the script will be run as root
Feb 26, 2013 18:59
you can do that, just do not put sudo
Feb 26, 2013 18:58
that's why I had you undo it
Feb 26, 2013 18:58
exactly