2

I have one problem with sudo. When I run sudo in regular account I get:

sudo: PERM_ROOT: setresuid(0, -1, -1): Permission denied
sudo: error initializing audit plugin sudoers_audit

But I commented the line where was written Plugin audit in /etc/sudo.conf. And here is my /etc/sudoers:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL
running ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "@include" directives:

@includedir /etc/sudoers.d
root ALL=(ALL:ALL) NOPASSWD:ALL
running ALL=(ALL:ALL) NOPASSWD:ALL

Note that sudo works without problem in root account but only fails at regular account(regular account is running here.)

How can I solve this??

1
  • I think (guess) it can be a problem with a setresuid call in your script. See the EPERM error on the man page... I don't know if there is a way to solve it... Nov 29, 2021 at 12:41

1 Answer 1

0

The error sudo: PERM_ROOT: setresuid(0, -1, -1): Permission denied occurs when the process/ user lacks the CAP_SETUID capability. The man page setresuid(2) (Link) mentions this as being required.

The lack of this capability can stem from multiple sources, like a restricted cgroup or systemd unit. Without more information on your user account/ execution context a concrete answer can't be given here.

You could try to track down your current capabilities by inspecting one of your own processes with grep Cap /proc/<pid>/status. This should show your all enabled capabilities.

For systemd units the CapabilityBoundingSet and related options are responsible for handling capabilities. In this case you should take a look at the unit file and/ or relate process.

Some capabilities can also be bound to the user as discussed in this SO question.

PS: This answer is most likely to late. However, I encountered this recently and wanted to share the solution for the next person stumbling across this question.

1
  • Yes, answer was way more late but let's hope that it will help next person who faces with it. Thanks for your answer. Feb 16, 2023 at 21:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .