为什么 Linux Mint 18 上 visudo 中的 NOPASSWD 不起作用

为什么 Linux Mint 18 上 visudo 中的 NOPASSWD 不起作用

这是一个 sudoers 文件,我在Debian 9服务器和它作品/etc/sudoers包含:

Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root        ALL=(ALL:ALL) ALL
# the following line I've added for sudo to work on Debian, which by default does not
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

这意味着我现在可以运行以下命令而无需输入密码:

sudo teamviewer daemon disable
sudo teamviewer daemon enable

然而,这是一个非工作的sudoers 文件上Linux 薄荷 18从某种意义上说,它仍然要求我输入密码。/etc/sudoers包含:

Defaults    env_reset
Defaults    mail_badpass
Defaults    secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root        ALL=(ALL:ALL) ALL
# this line I've added myself, because I felt it is needed, however user vlastimil has had sudo access all the time, added just now
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish, but it does not work
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

我猜想 Debian 和 Mint 之间存在一些差异,这使得添加的行不起作用。

我在本页上读到了不同的答案:

如何在没有密码提示的情况下以 root 身份运行特定程序?

但我对此并不聪明。

编辑1:

第一个答案在 Linux Mint 上给出了一个奇怪的错误:

$ sudo /usr/bin/teamviewer
 Init...
 *** TeamViewer can not be executed with sudo! ***
 Either use your normal user account without sudo
 or use a the real root account to log in to your desktop (not recommended!).

我也不明白这个。


$ which teamviewer
/usr/bin/teamviewer

$ file /usr/bin/teamviewer
/usr/bin/teamviewer: symbolic link to /opt/teamviewer/tv_bin/script/teamviewer

$ file /opt/teamviewer/tv_bin/script/teamviewer 
/opt/teamviewer/tv_bin/script/teamviewer: Bourne-Again shell script, ASCII text executable

$ cat /opt/teamviewer/tv_bin/script/teamviewer
#!/bin/bash

# If you see this message, you probably attempted to start TeamViewer.
# Please open a terminal (Konsole, gnome-terminal, xterm),
# navigate to this folder (type 'cd /path/to/teamviewer' [Enter])
# then execute TeamViewer (type './teamviewer' [Enter])


TV_SCRIPT_DIR="$(dirname "$(readlink -e "$0")")"
source "$TV_SCRIPT_DIR/tvw_main"

Main "$@"

编辑2:

例如在 AskUbuntu 上,正如评论中所建议的:

为什么 sudoers NOPASSWD 选项不起作用?

在许多其他地方,有一个解决方案,他们将规则管理员组规则。我已经尝试过,甚至之后重新启动,但它仍然不起作用。

答案1

# this line I've added myself, because I felt it is needed, however user vlastimil has had sudo access all the time, added just now
vlastimil   ALL=(ALL:ALL) ALL
# and this line I've added just now, so I could enable / disable teamviewer daemon as I wish, but it does not work
vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

第一条评论表明您的用户是该组的成员sudo,这就是 Linux Mint 上的用户sudo默认获得访问权限的方式。该sudo小组的规则随后出台:

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

最后的匹配规则获胜。当后面的规则也适用时,前面vlastimil的规则并不重要。NOPASSWDNOPASSWD规则应该在这条规则之后。这就是为什么使用文件/etc/sudoers.d有效,因为这些文件是最后包含的:

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

如果要将多个文件添加到sudoers.d,请使用编号文件名约定 ( XX-somefile),以便可以可靠地对它们进行排序并确保规则的正确优先级。

答案2

基于 Ubuntu 16.04 的 Linux Mint 18.2 上的一种解决方案是使用创建单独的 sudoers 文件visudo,例如:

sudo visudo -f /etc/sudoers.d/teamviewer

并添加额外的行:

vlastimil   ALL = (root) NOPASSWD: /usr/bin/teamviewer

进去。它很可能也是最优雅的解决方案,但这只是见仁见智的问题。

答案3

这是为二进制文件定义的绝对路径teamviewer

vlastimil为什么不以用户身份尝试以下操作

$ sudo /usr/bin/teamviewer

相关内容