13

I had already asked this question in Stack Overflow, but I've been asked to post it here. So doing the same.

I ran this command using my java program-

sudo -u <username> -S pwd

I got this output-

command=sudo -u <username> -S pwd
exitCode=1
sudo: sorry, you must have a tty to run sudo

I tried editing /etc/sudoers but it already contains

<username>       ALL=(ALL)       NOPASSWD: ALL

Then, I learned that this can be done by commenting out the following code in /etc/sudoers

# Defaults requiretty

Also, by default, when attempting to execute a command as another user using sudo, we have to provide our own password. But this can be changed by making the following change in /etc/sudoers-

Defaults targetpw

My Question is, is it possible to execute my above command in java without making any changes anywhere i.e. by having default settings?

2
  • 1
    Is this why you were asking the rather contrived Alternative for sudo?
    – slhck
    Aug 19, 2013 at 9:00
  • 6
    Seems distro specific if requiretty is enabled by default. According to sudo's own documentation it is "off by default."
    – mpy
    Aug 19, 2013 at 9:32

2 Answers 2

3

I don't know how to run shell commands in Java but have a look at -t option for ssh command

-t force pseudo-tty allocation.

That is what I do when I need to run command as root over ssh(direct root login disable and tty required by sudo)

2
  • 1
    While this approach could solve the problem at first sight it is not clear at all how is it related to the question. Could you please explain in more details? Nov 12, 2013 at 8:25
  • 1
    +1 for solving the problem without needing to change any default settings.
    – Luke
    Jan 31, 2014 at 4:54
1

My Question is, is it possible to execute my above command in java without making any changes anywhere i.e. by having default settings?

sudo -u -S pwd

The short answer is no, you will need to change settings to get sudo to do things differently than it currently does.

sudo may be the wrong tool for this. Sudo's rules are there to help system administrators configure a way to gain elevate privileges that is difficult to abuse to get additional/unintended privileges.

If you consider what sudo does for you:

  1. prompts for password to verify identity
  2. elevate privileges
  3. then optionally get privileges as another user
  4. logs sudo use to gain access or run commands

If you want your java to run arbitrary commands as arbitrary users without providing password for either those users or your own you are essentially replacing sudo. In that case you should create your own rules for how to prevent abuse.

There are basically two ways to do this:

  1. run your java with elevated privileges and carefully take and give back privileges you need (see setuid() seteuid() C function calls).
  2. run an external program to grab elevated privileges when you want them

In the case of #1 your java program is performing itself what sudo does, and you should implement your own set of rules to protect from abuse.

There are programs other than sudo to do #2. One example can be found in https://code.google.com/archive/p/exec-wrapper/downloads

This handy shell script creates a C program to run another command (usually a script). Then you compile the C program to a binary and mark that setuid root or really it could be setuid to any user. (mode :4555 and owner: root)

As long as you are on a filesystem that allows it, running the binary program will run the configured command as the userid that owns the binary program itself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .