2

I am using Raspbian Buster on an Raspberry Pi 4. I would like to give permissions to a non-root user to be able to set the time with /bin/date -s. The user is going to be used to run a python script using a systemd service. I have tried following the instructions here and here without success. Those posts were not for Raspbian but I checked and it seems Debian uses the same thing.

One thing I tried while troubleshooting was to set pam_cap.so to required instead of optional, but then when running the su command it says su: Module is unknown, which seems to indicate that it can't find pam_cap.so at all... I confirmed I have libcap2 and libcap2-bin installed though so I am not sure what I am missing... EDIT: I did a search for pam_cap.so on the system and couldn't find it, so that part makes sense I suppose... Does anyone know how to install it?

The specific steps I have taken are:

sudo useradd tasks_user
sudo sed '/pam_rootok.so/i auth        optional    pam_cap.so' /etc/pam.d/su -i
sudo setcap CAP_SYS_TIME+ei /bin/date

sudo su - tasks_user
capsh --print

I've tried restarting at every point in the process but it doesn't help. I confirmed that running sudo setcap CAP_SYS_TIME+ep /bin/date works, but this gives access to all users, which is not ideal...

Improve this question
2
  • 1
    Note sure why the user needs to change the date - I could see lots off issues but it's your machine. Have you looked at using the sudoers file and allowing the date command for that user in it?
    – user115418
    Commented May 23, 2020 at 15:35
  • You could always copy the date binary to a directory in the user's home and permit no one else to access the directory, then setcap that copy.
    – meuh
    Commented May 23, 2020 at 17:00

2 Answers 2

Reset to default
5

I suggest you allow the command to be issued with sudo. This would remind the user that they are using a privileged command.

sudo visudo

then add the following line to the end of the file

tasks_user ALL=NOPASSWD: /usr/bin/date

The tasks_user can issue the command using sudo.

E.g.

tasks_user:~$ sudo date -s "2020-05-23 16:31:10"
Sat 23 May 16:31:10 BST 2020
Improve this answer
2

It looks like pam_cap.so can be installed with the libpam-cap package, which seems obvious in retrospect... After that everything worked as expected.

The reason I am marking this as the correct answer is because I would prefer not to have to use sudo for some commands and not others, which is what would be required if editing the sudoers file as suggested in joan's answer.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.