Solved
Besides not commenting the #includedir line in /etc/sudoers out, editing
sudoers.d/myOverrides
withsudo visudo -f /etc/sudoers.d/myOverrides
, and using the syntax I first tried, did the trick.
And if you don't want to be an idiot like me, make sure you override the file by removing the .tmp when saving visudo and you're sure your syntax is correct. Although this wasn't the issue here, it easily could have been ;-)
I want to write a shell script which ought to dismount and close a LUKS container, running sudo cryptsetup luksClose XYZ
.
What's special about cryptsetup
, is that it uses the kernel module
device-mapper
to manage luks containers. What I could get out of the manual is: it relies on this kernel module and there is no way to circumvent this.
This means that it has to be run as sudo, so the program can later call device-mapper as root. But you can also run it without sudo without errors, until the device-mapper is called.
I tried using visudo
to stop sudo asking for a pw, as long sudo cryptsetup
is called.
First by using
user ALL=(ALL) NOPASSWD: /sbin/cryptsetup
but I realized that this doesn't mean cryptsetup is run as sudo, but it merely doesn't require sudo anymore to be called. Which it doesn't in the first place.
Then I tried to trick it using /sbin/cryptsetup as an argument for /bin/sudo
user ALL=(ALL) NOPASSWD:/bin/sudo /sbin/cryptsetup
(At all times the line was appended at the bottom of the sudoers file to make it the last interpreted line)
Is there another way to give my user account the permission to run "sudo cryptsetup luksClose XYZ" as it is, without PW? (Or something I'm missing in the cryptsetup manual)
EDIT: I'm using usually PCManFM to manage the container, and it doesn't require me to enter a PW for closing a container (just for decryption ofc) What is this sorcery?
EDIT 2: If there's not an easy answer I will just run the script as root at boot and make it wait for keyinput from user, instead of using keyboard shortcuts to run two seperate open/close scripts. I guess this way I don't have to make anything NOPASSWD at all, which is good.
But I'd like to know anyway.
Thanks in advance