3

I've set up VMWare Player for my wife. Every once in a while (notably after a kernel update), the VMWare Player needs to be compiled into the kernel.

My spouse does not have su- activated (if anybody screws up the OS, it's going to be me). I'd like to give her permission to do this, but only for that program.

Is this possible? Can it be done safely (for the OS)? How can it be done?

Edit: I tried to add the following to visudo

guijunkette ALL=(ALL) NOPASSWD: /usr/bin/vmware-modconfig

When running with her user, after typing her password, the following error occurred: Error

So, in the end, no cigar.

Edit: I've given up on VMWare Player and moved to VirtualBox. Made a clean install.

10
  • So...did it work?
    – ish
    Jul 15, 2012 at 2:14
  • @izx, didn't work so far. See my edit.
    – GUI Junkie
    Jul 24, 2012 at 17:27
  • Looking at the meta-problem - rebuilding a module on kernel upgrades: this sounds like a perfect job for dkms - the modules would be rebuilt when a new kernel is installed (rather than having to do it manually). Also, I see that there's a open-vm-dkms package - maybe this does what you need? Jul 27, 2012 at 8:06
  • @JeremyKerr, so, how would you go about that? Just a sudo apt-get install open-vm-dkms, sit back and relax?
    – GUI Junkie
    Jul 27, 2012 at 8:36
  • @GUIJunkie, yeah, I'd give that a go :) Jul 27, 2012 at 8:51

1 Answer 1

3
+50

Note: If you want VMWare Player to perform the update automatically, I don't think it's possible via sudoers; that's because VMWare uses its own graphical sudo front-end to check if the user has unrestricted sudo privileges...

A trace shows that this is how the GUI update is called when you start VMWare Player and it detects a new kernel:

/usr/lib/vmware/bin/vmware-gksu --sudo-mode --message=Please enter your password to proceed. '/usr/bin/vmware-modconfig' --icon='vmware-player' --appname='VMware' --gcc='/usr/bin/gcc' --headers='/lib/modules/3.2.0-27-generic/build/include'  

As you've already tried, even simply adding /usr/bin/vmware-modconfig doesn't work.

We'll assume your spouse's username is guijunkette. The script to manage the VMWare kernel modules is /usr/bin/vmware-modconfig; in light of the note above, it's best to explicitly invoke this from the terminal; to make life easier for your wife, I have included a desktop shortcut so that she needn't even open the terminal.

  1. sudo visudo
  2. Around line 25, below the line %sudo ALL=(ALL:ALL) ALL, insert:

    guijunkette  ALL=(ALL) NOPASSWD: /usr/bin/vmware-modconfig --console --install-all
    
  3. Exit the editor

To rebuild the modules, she can now run sudo vmware-modconfig --console --install-all without being asked for a password.

Desktop Shortcut

What you can do is create the following desktop file in your wife's ~/Desktop folder, and whenever VMWare Player flashes the "You must..." message, ask her to click Cancel, run this shortcut, and then start VMware Player (successfully) again:

[Desktop Entry]
Name=Update VMWare Modules
GenericName=VMWare Updater
Comment=Update VMWare modules for a new kernel (console mode)
Exec=sudo vmware-modconfig --console --install-all
Terminal=true
Icon=/usr/lib/vmware/share/icons/hicolor/48x48/actions/vm-upload.png
Type=Application
StartupNotify=true

Paste this into, e.g. /home/guijunkette/Desktop/vmwareupdater.desktop, and remember to chmod +x it.

Here's a demo:

enter image description here

16
  • I'll give that a try and report back.
    – GUI Junkie
    Jul 3, 2012 at 23:16
  • I've made the change to the visudo file, even though I can't find the config-tools at /usr/bin/. I'm hoping that file gets created when needed.
    – GUI Junkie
    Jul 7, 2012 at 9:31
  • @GUIJunkie: Sorry, I made a mistake in giving you the VMWare tools command instead of vmware-modconfig. Please see edits, including the recommended way to invoke a module rebuild.
    – ish
    Jul 26, 2012 at 18:19
  • I'll try that first thing in the morning :-)
    – GUI Junkie
    Jul 26, 2012 at 20:42
  • Regarding security, specifying the allowed command-line arguments prevents privilege escalation (for example, by specifying an arbitrary program to run as root with the --gcc flag). But the problem is that you generally only have to build kernel modules when there is a new kernel version. This will work once, but it will never work again. It's necessary instead to allow --headers=... arguments specifying headers in /lib/modules, but not others. I'm not sure sudo can be configured to do this. Jul 26, 2012 at 23:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .