Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

During an installation, as usual, we create our main user account, and then we can do sudo commands with it without problem. Now, when I created another account, and I wanted to do sudo, it gave me error that the account is not in the sudoers file. In that file I found out that users in %admin and %sudo groups can gain root privileges. But my main account is not in neither one of those groups and I can do sudo with it without problem, but with the other account I can't. Is there something besides sudoers that I should know about? Thanks

share|improve this question
add comment

2 Answers 2

To answer the general question some programs use mechanisms that use polkit to screen for root privileges rather than using the /etc/sudoers approach. (For example, gparted, as I recall). The sudo command uses /etc/sudo and/etc/sudoers.d/* so be sure to check each file. LDAP can conceivably be used to source information, by the way.

My system is 12.04 and my sudo-capable accounts are in the sudo group. My pertinent polkit files are /etc/polkit-1/localauthority.conf.d/50-localauthority.conf and /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf. Yours may be different.


I assume you realize that if the sudoers file says %sudo that means user must be in the sudo group. I assume, but don't know, that a long lasting credential might persist after a policy (or group) change. I would think you would know if this had been done, however.

To pursue further I suggest that you post the contents of the /etc/sudoers and the files in /etc/sudoers.d/ and under the tree /etc/polkit-1/ and tell us what groups the two userids are added to. I don't believe there are any passwords or hashes in the files I'm mentioning.

share|improve this answer
    
To be pedantic, polkit does not dispense root privileges, rather, it confirms whether a user is authorised to perform an action. A system D-Bus service must already have root privileges. –  Flimm Dec 5 '12 at 23:24
    
@Flimm, I've edited to reword this section. Thanks for the comment. –  John S Gruber Dec 9 '12 at 17:17
    
Well, I had a look at the source code for gparted-pkexec, and discovered pkexec, which acts like sudo, but uses PolicyKit to check if the user has org.freedesktop.policykit.exec authorisation, or a specific authorisation for that specific binary. So PolicyKit may not dispense root privileges, but pkexec does! I learned something today! –  Flimm Dec 9 '12 at 21:37
add comment

The admin and sudoer groups should give the user the access needed. You will have to log the user out and back in again for the changes to take effect. Have a look at these answers for some pretty good instructions:

Create an administrator user in command line

share|improve this answer
    
No, I already logged out and in. Read my question carefully. I am asking how does the system give one user administrative permissions even though he is not in the sudoers, nor in the group which is in sudoers –  dac Sep 30 '12 at 2:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.