<div dir="ltr"><div dir="ltr"><div dir="ltr"></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 6, 2024 at 9:32 PM George Bingham <<a href="mailto:georgeb1962@gmail.com">georgeb1962@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div><div dir="ltr" class="gmail_signature"><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 6, 2024 at 8:34 PM Stephen Worthington <<a href="mailto:stephen_agent@jsw.gen.nz" target="_blank">stephen_agent@jsw.gen.nz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Tue, 6 Aug 2024 14:36:47 -0500, you wrote:<br>
<br>
<br>
>I have added this line to the sudoers file:<br>
><br>
>mythtv ALL=(george) NOPASSWD: /usr/bin/kdeconnect-cli *<br>
><br>
>which should allow mythtv user to run sudo -E -u george<br>
>/usr/bin/kdeconnect-cli -d <blah blah blah><br>
>But it still prompts for password when I attempt that in a shell (and so my<br>
>script fails).<br>
><br>
>What else needs to be done on ubuntu to make this work without a password<br>
>prompt???<br>
><br>
>(I know that's a ubuntu question, but y'all have more experience with these<br>
>thing than I , so hoping you've dealt with this sort of thing before).<br>
<br>
Sudoers is very fussy. In mine, I do not have the spaces, and I do<br>
not recognise the * at the end, so you might try:<br>
<br>
mythtv ALL=NOPASSWD:(george)/usr/bin/kdeconnect-cli<br>
<br>
And make sure you have set the permissions on the sudoers file<br>
correctly - only read access for user and group is permitted and the<br>
owner and group must be root. Even root can not have write access.<br>
<br>
Also, I have not allowed direct access to an executable, although that<br>
should work. I have always created a "helper" script file and given<br>
that sudoers permission. So the following is an example of what works<br>
(it allows my EPG script to rotate its own log files every time it<br>
gets run):<br>
<br>
root@mypvr:/etc/sudoers.d# cat stephen<br>
stephen ALL=NOPASSWD:/home/stephen/bin/logrotate.sh<br>
root@mypvr:/etc/sudoers.d# ll stephen<br>
-r--r----- 1 root root 52 Aug 25 2014 stephen<br>
root@mypvr:/etc/sudoers.d# ll /home/stephen/bin/logrotate.sh<br>
-rwxr-x--- 1 root mythtv 958 Sep 17 2021<br>
/home/stephen/bin/logrotate.sh*<br>
root@mypvr:/etc/sudoers.d# cat /home/stephen/bin/logrotate.sh<br>
#!/bin/bash<br>
#set -x<br>
<br>
if [ "$1" == "" ]; then<br>
exit 1<br>
fi<br>
<br>
if [ "$1" == "rotate2" ] || [ "$1" == "chown2" ]; then<br>
<br>
LOGFILE=/var/log/mythtv/tv_grab_dvb_plus_freeviewhd.log<br>
LOGSTATUS=/home/stephen/.logrotate/status2<br>
LOGCONFIG=/home/stephen/.logrotate/logrotate2.conf<br>
COMMAND=$1<br>
COMMAND=${COMMAND::-1}<br>
<br>
elif [ "$1" == "rotate1" ] || [ "$1" == "chown1" ]; then<br>
<br>
LOGFILE=/var/log/mythtv/tv_grab_dvb_plus.log<br>
LOGSTATUS=/home/stephen/.logrotate/status1<br>
LOGCONFIG=/home/stephen/.logrotate/logrotate1.conf<br>
COMMAND=$1<br>
COMMAND=${COMMAND::-1}<br>
<br>
else<br>
<br>
LOGFILE=/var/log/mythtv/epg_temp.log<br>
LOGSTATUS=/home/stephen/.logrotate/status<br>
LOGCONFIG=/home/stephen/.logrotate/logrotate.conf<br>
COMMAND=$1<br>
<br>
fi<br>
<br>
<br>
if [ "$COMMAND" == "rotate" ]; then<br>
<br>
# Rotate the log file.<br>
logrotate --force --state $LOGSTATUS $LOGCONFIG<br>
<br>
fi<br>
<br>
if [ "$COMMAND" == "chown" ]; then<br>
<br>
# Chown the log file.<br>
chown syslog:adm $LOGFILE<br>
fi<br>
<br>
This looks to be a good tutorial on sudoers:<br>
<br>
<a href="https://medium.com/kernel-space/linux-fundamentals-a-to-z-of-a-sudoers-file-a5da99a30e7f" rel="noreferrer" target="_blank">https://medium.com/kernel-space/linux-fundamentals-a-to-z-of-a-sudoers-file-a5da99a30e7f</a></blockquote><div><br></div><div><br></div><div>Thanks Stephen, Looking at that tutorial now.</div><div><br></div><div>I think my difficulties are that I'm having to allow the user 'mythtv' to run something as user '<me>' to run a command that utilizes my DBUS session. So it's not trying to do anything privileged. I've gotten sudo to allow a user to run a privileged command in a script without asking for a password, but this is the first time I've had it try to allow a user to switch users without asking for a password. That may be the sticking point.</div><div><br></div><div>I'll study that tutorial.</div><div><br></div><div>George</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br></blockquote></div></div></blockquote><div>Hey all,</div><div><br></div><div>I finally got it to work! </div><div><br></div><div>I was trying to allow the mythtv user to run kdeconnect-cli from a system event script as user me with it's DBUS_SESSION_BUS_ADDRESS environment variable set the same as mine, thus allowing an SMS notification to be sent to me when playback stops on my living room TV or when a recording is failing. </div><div><br></div><div>I had to setup a seperate 'sudoers' file I called "mythtv_kdeconnect" in /etc/sudoers.d/ with the following contents:</div><div><br></div><div>Defaults:mythtv env_keep += "DBUS_SESSION_BUS_ADDRESS"<br>mythtv ALL=(george) NOPASSWD: /usr/bin/kdeconnect-cli<br></div><div><br></div><div>Then, in my system event script, have to set the DBUS_SESSION_BUS_ADDRESS environment variable appropriately, and then run kdeconnect-cli like so:</div><div><br></div><div>sudo -u george /usr/bin/kdeconnect-cli <blah blah blah></div><div><br></div><div>Simple huh? Took me a lot of trial and error to get this working. Hope it'll help someone else.</div><div><br></div><div>George</div></div></div></div>