1

I executed the following commands to set up a guest account.

sudo adduser guest 
sudo chmod g+w /home/guest
sudo chmod o-rwx /home/* 
sudo usermod -aG guest pi

Then I put two working self executable shell scrips in the guest Desktop folder.

I used "chmod +x /home/guest//Desktop/xx" to make them executable from my Pi group.

I logged into guest, double click on the.sh file I get the "Execute in terminal" button but when I click on it, the terminal opens with; "(sudo) password for guest:"

One script is for avrdude.

#!/bin/bash

sudo avrdude -c linuxgpio -F -p atmega328p -v -U flash:w:/home/pi/xxxx

The other is just a shutdown file;

#!/bin/bash

sudo shutdown -h now

Update with info from comments:
What I am trying to do is to limit the user to execute the two scripts by clicking on them only. They need to program hundreds of printed circuit boards with the first .sh file, then, when finished for the day shutdown the Pi with the second. I'm wondering if there is a way to set the permission (just on the two above .sh files) so they alone have sudo permissions and work as they do in my Pi home folder.

  • 2
    These are highly linux related question. There is a better chance for an answer if you ask this question in the Unix & Linux group. As I understand your question correctly, you wonder why you are requested to enter a password? But thats how sudo works. You are looged in as guest then you start a script, a statement in this script is preceded by sudo, and before sudo grants you super user rights it asks for guests password. That's normal behavior. Did I understand the question wrong? – Peter Paul Kiefer Nov 5 '19 at 18:02
  • 1
    You understand my question exactly and thank you for responding. – Peter Veiga Nov 5 '19 at 19:33
  • 1
    But I need a work around. what I am trying to do is to limit the user to execute the two scripts by clicking on them only. They need to program hundreds of printed circuit boards with the first .sh file, then, when finished for the day shutdown the Pi with the second. – Peter Veiga Nov 5 '19 at 19:42
  • 1
    I'm wondering if there is a way to set the permission (just on the two above .sh files) so they alone have sudo permissions and work as they do in my Pi home folder. – Peter Veiga Nov 5 '19 at 19:44
  • You should explain what you are trying to achieve. The answer to your question as it is written is that your scripts are indeed executable, so there's nothing to worry about. sudo is expected to ask for a password. – Dmitry Grigoryev Nov 6 '19 at 8:00
2

sudo is powerful enough to do what you want. You can just add a policy file for sudo in /etc/sudoers.d/. Just do it with:

rpi ~$ sudo visudo /etc/sudoers.d/010_guest-nopasswd

In the empty editor insert these two lines with the correct path, save them and quit the editor:

guest ALL = (root) NOPASSWD: /full/path/to/avrdude
guest ALL = (root) NOPASSWD: /sbin/shutdown

The (root) entry ensures that the program can only be executed with root rights and not with rights of another user.

| improve this answer | |
  • I have the setup corrected and made it possible to give the guest access to the programs called by the script. – Ingo Dec 11 '19 at 1:27
1

You want two scripts, that are located in the Desktop folder to be executed only from the user guest. The user guest is logged in and starts the scripts by clicking it.

Set the owner of the script to guest:

sudo chown guest:guest script1.sh script2.sh

Then set the execute permission only for the owner.

sudo chmod 500 script1.sh script2.sh

The user root always can execute the scripts. If you want to prevent him from doing this. You have to test if the user is not equal to 'guest' and end the script before it can execute its work. But you can not keep the root from changing the permissions or the script content.

Example:

#!/bin/bash

if [[ "$USER" != "guest" ]] ; then return; fi 

sudo avrdude -c linuxgpio -F -p atmega328p -v -U flash:w:/home/pi/xxxx

See the answer of @Milliways if you are interested of password less sudo access. But if you grant sudo access to guest he/she can do everything.

I know a work around, but it is complex and I have not the time to explain it here completely. You can write a little program that is started by the root account (or by systemd at boot time). This program listens on a TCP port and if it gets a trigger and a password from your script is executes the avrdude or performs a shutdown. Depending on the command you send to it. Now your script have only to send the command over a tcp connection to a process the has root rights. And if you prepare scripts as described above, only the user guest can execute it.

EDIT: There is also an idea, that uses Unix signals with trap and kill statements in scripts. So you do not have to write programs. But you must know how Unix signals work and you need a method to inform the trigger script about the process id of the root scope scripts the should start avrdude or shutdown the system.

| improve this answer | |
  • It didn't work for me. See below. – Peter Veiga Nov 6 '19 at 14:14
  • pi@raspberrypi:~ $ chown guest:guest /home/guest/Desktop/L1_L2_Knight_Rider_New2.sh chown: changing ownership of '/home/guest/Desktop/L1_L2_Knight_Rider_New2.sh': Operation not permitted pi@raspberrypi:~ $ chmod 500 /home/guest/Desktop/L1_L2_Knight_Rider_New2.sh chmod: changing permissions of '/home/guest/Desktop/L1_L2_Knight_Rider_New2.sh': Operation not permitted pi@raspberrypi:~ $ – Peter Veiga Nov 6 '19 at 14:15
  • Sorry, of cause as pi is not the owner of the files the user pi can not access them to modify the access rights. But root can, you have to use sudo chown ... and sudo chmod 500 .... – Peter Paul Kiefer Nov 6 '19 at 14:19
  • The above commands executed with the "sudo' but when I log into the guest account the files still ask for password for guest in terminal. – Peter Veiga Nov 6 '19 at 14:40
  • Yes of cause. I mentioned that in my answer. As you have the sudo in the script it will ask you for a password. You can change that by creating passwordless sudo access see Milliways' answer. But that's not a good idea as he/she stated too. I've given you two workarounds (better the ideas of two workarounds) but I can not give you a complete example. But it's a fact, that you can not save use sudo without a password. – Peter Paul Kiefer Nov 6 '19 at 14:50
0

This is not a Pi specific question, but a general Linux question, although the Raspbian case differs from most other implementations which do not have passwordless sudo access.

The simple answer is that what you want to do is not possible.

It can be done for executable programs by setting the suid permissions, but this is NOT possible for script files.

The pi user has passwordless sudo access, and you can give this to other users, but they will be able to access ANY command with sudo. https://www.raspberrypi.org/documentation/linux/usage/users.md shows one way of giving a user passwordless sudo access, although in my view the process suggested is dangerous and an error risks making your Pi unusable.

It is far safer (but still not without risk) to give the user passwordless sudo by creating a /etc/sudoers.d/010_xxx-nopasswd file.

NOTE that sudo usermod -aG guest pi adds the guest to group pi - giving access to all of pi's files, which is probably not what you wanted to do.

sudo adduser guest sudo would make the guest a member of the group sudo, and thus grant sudo permissions (but not passwordless).

| improve this answer | |
  • There are some things wrong what you have written. – Ingo Dec 11 '19 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.