Alarm clock functionality - sleep and wakeup via scripts

[bukkit]

I put the op_power.sh in the /etc/sudoers. That way I can call that with sudo without having to provide a password. (This would be the Linux way, btw. WizardStan is correct in stating modifying the rights is generally not recommendable. He's also right in doubting there can be much harm, given the Pandora usage. It's probably seldom in a security-sensible multiuser-environment.)


I'm still working on organizing this a bit nicer, then will post here, if you're interested.

 

[ekianjo]

I put the op_power.sh in the /etc/sudoers. That way I can call that with sudo without having to provide a password.

How is it possible to call a sudo command without it requiring a password? I am not familiar with this feature.

 

[pmprog]

How is it possible to call a sudo command without it requiring a password? I am not familiar with this feature.

I heard about this when I was customising the mass storage script to support my USB Mass Storage plugin for the Config Button. It's a list of special applications (or scripts) that are allowed to run as root without requiring the user to enter the root password

 

[ekianjo]

But lets say you want your app to copy the said script in etc/sudoers, you would still need to have a password request popup, unless the script is already included in the firmware? That would need to happen at least once, right?

 

[pmprog]

Yes. You require root to modify the list - otherwise it's not very secure

 

[bukkit]

Yes, the general concept is: enable users to do jobs normally requiring root (like mounting a cd, configuring printers, stuff like that). It's not a security issue if the tasks and tools are carefully selected and the sudoers list is sensibly maintained.


... I see. You have to include freshly created scripts in that... this is also possible, but I'd recommend a different approach...


You need root rights for the call to op_power.sh. So you have your generated script do its work with the rights of the calling user. The script then calls sudo op_power.sh.


Another approach: You include a generic script in the sudoers list. This then can be called without password. I'd feed that with the required parameters (they can come from a text file, if you need to provide data in files).

 

[bukkit]

Ah. I believe I missed your point. You're saying you need root at least once to modify the /etc/sudoers.


That is of course true. You'd have to ask for the root password at the first execution ("installation").

 

[ekianjo]

Ah. I believe I missed your point. You're saying you need root at least once to modify the /etc/sudoers.


That is of course true. You'd have to ask for the root password at the first execution ("installation").

Yes that was my point. I guess it's ok if it can be done only once.

 

[bukkit]

This would be a very simple setup enabling you to run op_power.sh as root without password:

<username> ALL=(root) NOPASSWD:/usr/pandora/scripts/op_power.sh

You either replace <username> with ALL (dirty) or, correctly, with the name of the user supposed to be able to run the script, probably the current user. This goes in the /etc/sudoers, of course.



If you need more than that, sudoers can group users and programs and then assign rights to these groups. Nifty, but beyond your needs.



It's not needed in this case, but some applications might need the environment of the root user to run correctly. You'd allow that via

<username> ALL=(root)  SETENV: NOPASSWD:/usr/pandora/scripts/op_power.sh

and then can call the command via

sudo -E /usr/pandora/scripts/op_power.sh