1

I executed the following commands to set up a guest account.

sudo adduser guest 
sudo chmod g+w /home/guest
sudo chmod o-rwx /home/* 
sudo usermod -aG guest pi

Then I put two working self executable shell scrips in the guest Desktop folder.

I used "chmod +x /home/guest//Desktop/xx" to make them executable from my Pi group.

I logged into guest, double click on the.sh file I get the "Execute in terminal" button but when I click on it, the terminal opens with; "(sudo) password for guest:"

One script is for avrdude.

#!/bin/bash

sudo avrdude -c linuxgpio -F -p atmega328p -v -U flash:w:/home/pi/xxxx

The other is just a shutdown file;

#!/bin/bash

sudo shutdown -h now

Update with info from comments:
What I am trying to do is to limit the user to execute the two scripts by clicking on them only. They need to program hundreds of printed circuit boards with the first .sh file, then, when finished for the day shutdown the Pi with the second. I'm wondering if there is a way to set the permission (just on the two above .sh files) so they alone have sudo permissions and work as they do in my Pi home folder.

5
  • 2
    These are highly linux related question. There is a better chance for an answer if you ask this question in the Unix & Linux group. As I understand your question correctly, you wonder why you are requested to enter a password? But thats how sudo works. You are looged in as guest then you start a script, a statement in this script is preceded by sudo, and before sudo grants you super user rights it asks for guests password. That's normal behavior. Did I understand the question wrong? Commented Nov 5, 2019 at 18:02
  • 1
    You understand my question exactly and thank you for responding. Commented Nov 5, 2019 at 19:33
  • 1
    But I need a work around. what I am trying to do is to limit the user to execute the two scripts by clicking on them only. They need to program hundreds of printed circuit boards with the first .sh file, then, when finished for the day shutdown the Pi with the second. Commented Nov 5, 2019 at 19:42
  • 1
    I'm wondering if there is a way to set the permission (just on the two above .sh files) so they alone have sudo permissions and work as they do in my Pi home folder. Commented Nov 5, 2019 at 19:44
  • You should explain what you are trying to achieve. The answer to your question as it is written is that your scripts are indeed executable, so there's nothing to worry about. sudo is expected to ask for a password. Commented Nov 6, 2019 at 8:00

2 Answers 2

2

sudo is powerful enough to do what you want. You can just add a policy file for sudo in /etc/sudoers.d/. Just do it with:

rpi ~$ sudo visudo /etc/sudoers.d/010_guest-nopasswd

In the empty editor insert these two lines with the correct path, save them and quit the editor:

guest ALL = (root) NOPASSWD: /full/path/to/avrdude
guest ALL = (root) NOPASSWD: /sbin/shutdown

The (root) entry ensures that the program can only be executed with root rights and not with rights of another user.

1
  • I have the setup corrected and made it possible to give the guest access to the programs called by the script.
    – Ingo
    Commented Dec 11, 2019 at 1:27
1

You want two scripts, that are located in the Desktop folder to be executed only from the user guest. The user guest is logged in and starts the scripts by clicking it.

Set the owner of the script to guest:

sudo chown guest:guest script1.sh script2.sh

Then set the execute permission only for the owner.

sudo chmod 500 script1.sh script2.sh

The user root always can execute the scripts. If you want to prevent him from doing this. You have to test if the user is not equal to 'guest' and end the script before it can execute its work. But you can not keep the root from changing the permissions or the script content.

Example:

#!/bin/bash

if [[ "$USER" != "guest" ]] ; then return; fi 

sudo avrdude -c linuxgpio -F -p atmega328p -v -U flash:w:/home/pi/xxxx

See the answer of @Milliways if you are interested of password less sudo access. But if you grant sudo access to guest he/she can do everything.

I know a work around, but it is complex and I have not the time to explain it here completely. You can write a little program that is started by the root account (or by systemd at boot time). This program listens on a TCP port and if it gets a trigger and a password from your script is executes the avrdude or performs a shutdown. Depending on the command you send to it. Now your script have only to send the command over a tcp connection to a process the has root rights. And if you prepare scripts as described above, only the user guest can execute it.

EDIT: There is also an idea, that uses Unix signals with trap and kill statements in scripts. So you do not have to write programs. But you must know how Unix signals work and you need a method to inform the trigger script about the process id of the root scope scripts the should start avrdude or shutdown the system.

13
  • It didn't work for me. See below. Commented Nov 6, 2019 at 14:14
  • pi@raspberrypi:~ $ chown guest:guest /home/guest/Desktop/L1_L2_Knight_Rider_New2.sh chown: changing ownership of '/home/guest/Desktop/L1_L2_Knight_Rider_New2.sh': Operation not permitted pi@raspberrypi:~ $ chmod 500 /home/guest/Desktop/L1_L2_Knight_Rider_New2.sh chmod: changing permissions of '/home/guest/Desktop/L1_L2_Knight_Rider_New2.sh': Operation not permitted pi@raspberrypi:~ $ Commented Nov 6, 2019 at 14:15
  • Sorry, of cause as pi is not the owner of the files the user pi can not access them to modify the access rights. But root can, you have to use sudo chown ... and sudo chmod 500 .... Commented Nov 6, 2019 at 14:19
  • The above commands executed with the "sudo' but when I log into the guest account the files still ask for password for guest in terminal. Commented Nov 6, 2019 at 14:40
  • Yes of cause. I mentioned that in my answer. As you have the sudo in the script it will ask you for a password. You can change that by creating passwordless sudo access see Milliways' answer. But that's not a good idea as he/she stated too. I've given you two workarounds (better the ideas of two workarounds) but I can not give you a complete example. But it's a fact, that you can not save use sudo without a password. Commented Nov 6, 2019 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.