1

Solved

Besides not commenting the #includedir line in /etc/sudoers out, editing sudoers.d/myOverrides with sudo visudo -f /etc/sudoers.d/myOverrides, and using the syntax I first tried, did the trick.

And if you don't want to be an idiot like me, make sure you override the file by removing the .tmp when saving visudo and you're sure your syntax is correct. Although this wasn't the issue here, it easily could have been ;-)


I want to write a shell script which ought to dismount and close a LUKS container, running sudo cryptsetup luksClose XYZ.

What's special about cryptsetup, is that it uses the kernel module device-mapper to manage luks containers. What I could get out of the manual is: it relies on this kernel module and there is no way to circumvent this.

This means that it has to be run as sudo, so the program can later call device-mapper as root. But you can also run it without sudo without errors, until the device-mapper is called.

I tried using visudo to stop sudo asking for a pw, as long sudo cryptsetup is called.

First by using

user ALL=(ALL) NOPASSWD: /sbin/cryptsetup

but I realized that this doesn't mean cryptsetup is run as sudo, but it merely doesn't require sudo anymore to be called. Which it doesn't in the first place.

Then I tried to trick it using /sbin/cryptsetup as an argument for /bin/sudo

user ALL=(ALL) NOPASSWD:/bin/sudo /sbin/cryptsetup

(At all times the line was appended at the bottom of the sudoers file to make it the last interpreted line)

Is there another way to give my user account the permission to run "sudo cryptsetup luksClose XYZ" as it is, without PW? (Or something I'm missing in the cryptsetup manual)

EDIT: I'm using usually PCManFM to manage the container, and it doesn't require me to enter a PW for closing a container (just for decryption ofc) What is this sorcery?

EDIT 2: If there's not an easy answer I will just run the script as root at boot and make it wait for keyinput from user, instead of using keyboard shortcuts to run two seperate open/close scripts. I guess this way I don't have to make anything NOPASSWD at all, which is good.

But I'd like to know anyway.

Thanks in advance

1 Answer 1

2

Your first syntax for the no-password use of cryptsetup is correct. I use this for an alias I created for suspending the system:

me        ALL=(ALL:ALL) NOPASSWD: /bin/systemctl suspend

I still have to use sudo in my alias: alias quit='sudo systemctl suspend'

I would personally put the exact command that you want, with all of the options, so that your sudo privileges are restricted to just what is necessary.

1
  • Ok, I ended up editing /etc/sudoers.d/myOverrides using the same syntax and it works. Thanks for verifying the syntax. Edit: Although I just realized I didn't uncommented the #includedir line. It just worked, also without rebooting, logging off or anything. I wish I knew what I did..
    – hghtch
    Aug 3, 2019 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .