Release Smart sudo script

Discussion in 'Software Releases' started by dimag0g, Mar 2, 2014.

  1. dimag0g

    dimag0g Very Active Member

    Joined:
    Jan 12, 2011
    Messages:
    607
    Location:
    Strasbourg, France
    Smart Sudo is a new tool I'm working on. It helps you to configure your system so actions usually requiring a password entry could be executed without entering it.

    I have tested it quite extensively, but before you try it, you must know how to recover from broken sudo config. Basically, if you haven't set your root password and have no clear idea about sudo config files, you might have to reflash your pandora in order to recover. You've been warned.

    Now, a couple of examples:

    Wakeup alarm:
    - Download Wakeup alarm PND from the repo and run it
    - Note that a password is needed to program the timer
    - Run Smart sudo, and install "echosu" on your system
      (echosu script enables passwordless hardware access)
    - Rerun Wakeup Alarm. Now it should work without password

    Swap files:
    - Download Swap files PND from the repo and run it
    - Note that a password is needed to enable/disable swap
      (commands "swapon" and "swapoff" are concerned)
    - Run Smart sudo and add "swapon" and "swapoff" to sudoers
    - Now Swap tools could run without password. However,
      it doesn't know you added "swapon" and "swapoff" to
      sudoers, so it keeps asking for a password anyway.
    - Run Smart sudo and install smart gksudo script
      (it checks if password is really needed before asking)
    - Rerun Swap tools. Now it should work without password

    Upgrade Pandora OS:

    - go to main menu -> System -> Upgrade pandora OS

    -  note that a password is needed to run upgrade script

    - Run Smart Sudo and add "opkg" to sudoers

    - make sure smart gksudo script is installed

     (same reason as for Swap tools)

    - Rerun Upgrade script. Now it should work without password
     
    Last edited by a moderator: Nov 5, 2014
    Tags:
  2. FBnil

    FBnil Waterfox > firefox

    Joined:
    Dec 14, 2012
    Messages:
    2,420
    Location:
    Yurp
    nice... (still concerned about security though...)

    This does not throw a warning:

    ./echosu 25 "/sys/class/\\.\\.\/\\.\\./tmp/aaa&&rm -rf /"
     

    http://alvinalexander.com/blog/post/linux-unix/how-remove-non-printable-ascii-characters-file-unix

    In our case, the allowed characters are more stringent, not allowing space, ampersand, dotcomma, etc...

    so to stop bobby tables. \; type of code...

    Please also check $1 -gt 0 or at least numeric...

    I've created a C solution (but am also not so confident it works without glitches). Will attach soon.
     
    Last edited by a moderator: Mar 2, 2014
  3. FBnil

    FBnil Waterfox > firefox

    Joined:
    Dec 14, 2012
    Messages:
    2,420
    Location:
    Yurp
    Use CodeBlocks to compile with it's command line:

    make op_wakealarm

    (there is a compiled version in the zip)

    instead of commandline sudo, use the GUI version gksudo

    sudo chown root:users op_wakealarm
    sudo chmod 4750 op_wakealarm

    This does not need sudo:
    cat /sys/class/rtc/rtc0/wakealarm

    This does:
    ./op_wakealarm `date '+%s' -d '+ 3 minutes'`

    ps: Because we use atoi in the code, it gets untainted/sanitized automatically. so the potato function is not required, but it still deters :)

    OP.zip
     

    Attached Files:

    • OP.zip
      File size:
      4.5 KB
      Views:
      45
    Last edited by a moderator: Mar 2, 2014
  4. Zero3K

    Zero3K Active Member

    Joined:
    Sep 27, 2003
    Messages:
    828
    Location:
    USA
    Please make a PND of it. Thanks.
     
    Last edited by a moderator: Mar 2, 2014
  5. FBnil

    FBnil Waterfox > firefox

    Joined:
    Dec 14, 2012
    Messages:
    2,420
    Location:
    Yurp
    We are actually hoping that it would be incorporated in Alarm Clock. But that is not required.

    The thing is, to get that working we need 3 things:

    * modify Alarm Clock.

    * modify /usr/pandora/scripts/op_power.sh

    * Package the result in a new version of smartsudo

    So Alarm Clock has its settings in /mnt/utmp/alarmclock/alarm-clock/alarms.conf

    We assume that when the alarm clock is not running, this binding to the ./appdata/ does not exist, and wakeup is not required.

    During a software or hardware low power mode call (either using the GUI or the slide) the script op_power.sh gets called. always afaik.

    We can just make a PND that does a modification in this script. It test for the existance of the alarms.conf

    If it is there, I can run a grep DateTime on that file and get the youngest date, substract like, 5 seconds, and use op_wakealarm to let it wake.

    During each pandora wake up, we again test if the alarm is set, if so, set it to zero (just in case we wake the pandora up manually)

    dimag0g & Zero3K, do you agree on this method?

    estimated time of programming: Longer than it took to post this (including looking up the references on the internet)

    -------

    Now AlarmClock is written in C with GTK bindings. So Ill have to ask Sebt3 where he got his sources from.

    Debian actually uses 1.2.5 and I can find the sources for that: https://launchpad.net/ubuntu/trusty/+source/alarm-clock

    But We use the 1.4.x version and that has the following bug fixed:

    2010-05-30  * src/alarm_thread.c: fixed missed alarms feature

    This is to change the toolbutton1 label in alarm-clock.ui and remove the include directory from the PND (hey, that can be done without recompiling, just repackaging)
     
    Last edited by a moderator: Mar 3, 2014
  6. Zero3K

    Zero3K Active Member

    Joined:
    Sep 27, 2003
    Messages:
    828
    Location:
    USA
    I don't care about using it with the Alarm Clock program. I just like not needing to input my password to do upgrades, etc.
     
  7. dimag0g

    dimag0g Very Active Member

    Joined:
    Jan 12, 2011
    Messages:
    607
    Location:
    Strasbourg, France
    You should be :) there is no way this PND goes to the repo in its current state. There's Bobby Tables issue like you said, but there's also echo 9000 > /sys/class/power_supply/mains/charge_current. Or there could be a malware which activates wifi and switches off the led, communicating without the user knowing. And those are much harder to fix.
     
  8. dimag0g

    dimag0g Very Active Member

    Joined:
    Jan 12, 2011
    Messages:
    607
    Location:
    Strasbourg, France
    Why? echo "on" > /sys/class/device doesn't look legitimate?
     
  9. dimag0g

    dimag0g Very Active Member

    Joined:
    Jan 12, 2011
    Messages:
    607
    Location:
    Strasbourg, France
    Maybe entering the password for firmware upgrades isn't a bad idea after all. It's little trouble, considering you do that maybe once a month. But if you really want to do it, adding opkg to sudoers might help.

    Anyhow, I have discovered that many existing PNDs which need root access usually don't execute just critical parts with sudo, but rather rather do something like "sudo ./runscript.sh", and the script does all the dirty work inside. If you want these to run without password, you'd have to give up any protection altogether. So, if you have any particular applications in mind, I suggest you to approach their authors and discuss how those apps could cope with sudo better.
     
    Last edited by a moderator: Mar 3, 2014
  10. dimag0g

    dimag0g Very Active Member

    Joined:
    Jan 12, 2011
    Messages:
    607
    Location:
    Strasbourg, France
    By the way, I've just tried your trick and it doesn't work. Are you quite sure you spelled it correctly?
     
  11. FBnil

    FBnil Waterfox > firefox

    Joined:
    Dec 14, 2012
    Messages:
    2,420
    Location:
    Yurp
    Ah, is that all... ok, first, open a terminal and type:


    sudo visudo

    This starts VI. Make sure you edit at the end of the file ( :$ enter )

    Then open the edit mode with o and type in:


    userid ALL=NOPASSWD: ALL

    Press Escape then :wq  (write quit)

    Now, run to test:

    gksudo /usr/pandora/scripts/op_power.sh

    If your machine sleeps, great it is working.

    --------------------

    Second topic: Wake up 10 seconds before the first alarmclock wakeup call.

    Replace the op_power.sh in /usr/pandora/scripts

    This will monitor if 1. alarmclock is running, then it will "activate"

    One problem I see is that alarmclock abends with a Segmentation fault because the software is unstable (does also happen with the older version on Debian itself... sigh...):

    =======================================================================================


    PND : /media/klomp/pandora/menu/alarmclock.pnd


    PND_FSTYPE : Squashfs


    APPDATADIR : /media/klomp/pandora/appdata/alarmclock


    APPDD_FSTYPE : ext3


    PND_CPUSPEED :


    EXENAME : scripts/alarm-clock.sh


    ARGUMENTS :


    =======================================================================================


    [ START ]--- Mount the PND ----------


    Mounting : mount -t squashfs -o ro "/dev/loop1" "/mnt/utmp/alarmclock"


    Mounting the Union FS : mount -t aufs -o exec,dirs="/media/klomp/pandora/appdata/alarmclock=rw+nolwh":"/mnt/pnd/alarmclock=rr" none "/mnt/utmp/alarmclock"


    [sUCCESS]--- Mount the PND ----------


    [ START ]--- Starting the application ( scripts/alarm-clock.sh ) ----------

    (alarm-clock:2541): Gtk-CRITICAL **: gtk_list_store_set_valist: assertion `VALID_ITER (iter, list_store)' failed


    /usr/pandora/scripts/pnd_run.sh: line 522: 2541 Segmentation fault "./$EXENAME" $ARGUMENTS "$@"


    [ FAILED]--- Starting the application ( scripts/alarm-clock.sh ) ----------


    [ START ]--- Restoring the frame buffer status ----------


    [sUCCESS]--- Restoring the frame buffer status ----------


    [ START ]--- uMount the PND ----------


    [ START ]--- Waiting the Union to be available ----------


    [sUCCESS]--- Waiting the Union to be available ----------


    auplink:plink.c:223: AUFS_CTL_PLINK_MAINT: Inappropriate ioctl for device


    rmdir: failed to remove `/mnt/utmp/alarmclock': Device or resource busy


    [ START ]--- Waiting the PND mount dir to be free ----------


    [sUCCESS]--- Waiting the PND mount dir to be free ----------


    cleanup done


    [sUCCESS]--- uMount the PND ----------


    =======================================================================================


    Return code is : 3

    Reproducing the error:

    Create a schedule weekly, create a schedule for tomorrow morning. Then:

    Create an entry 1 minute in the future. Wait for the ring. Then do this again. The application abends just one second after ringing.

    op_power.sh.zip
     

    Attached Files:

    Last edited by a moderator: Mar 3, 2014
  12. FBnil

    FBnil Waterfox > firefox

    Joined:
    Dec 14, 2012
    Messages:
    2,420
    Location:
    Yurp
    one other thing: you can also skip one of the processes from going into sleepmode by not doing a kill -STOP, If we look at orageclock, it consumes 0.3 CPU, alarmclock uses more, but much less if minimized (never use the X to close the window, always use the trayicon, this way, you can unminimize properly).
     
  13. dimag0g

    dimag0g Very Active Member

    Joined:
    Jan 12, 2011
    Messages:
    607
    Location:
    Strasbourg, France
    @FBnil, maybe you should start a separate thread about alarmclock instead of posting here
     

Share This Page

Loading...