I've set up VMWare Player for my wife. Every once in a while (notably after a kernel update), the VMWare Player needs to be compiled into the kernel.

My spouse does not have su- activated (if anybody screws up the OS, it's going to be me). I'd like to give her permission to do this, but only for that program.

Is this possible? Can it be done safely (for the OS)? How can it be done?

Edit: I tried to add the following to visudo

guijunkette ALL=(ALL) NOPASSWD: /usr/bin/vmware-modconfig

When running with her user, after typing her password, the following error occurred: Error

So, in the end, no cigar.

Edit: I've given up on VMWare Player and moved to VirtualBox. Made a clean install.

  • So...did it work? – ish Jul 15 '12 at 2:14
  • @izx, didn't work so far. See my edit. – GUI Junkie Jul 24 '12 at 17:27
  • Looking at the meta-problem - rebuilding a module on kernel upgrades: this sounds like a perfect job for dkms - the modules would be rebuilt when a new kernel is installed (rather than having to do it manually). Also, I see that there's a open-vm-dkms package - maybe this does what you need? – Jeremy Kerr Jul 27 '12 at 8:06
  • @JeremyKerr, so, how would you go about that? Just a sudo apt-get install open-vm-dkms, sit back and relax? – GUI Junkie Jul 27 '12 at 8:36
  • @GUIJunkie, yeah, I'd give that a go :) – Jeremy Kerr Jul 27 '12 at 8:51

Note: If you want VMWare Player to perform the update automatically, I don't think it's possible via sudoers; that's because VMWare uses its own graphical sudo front-end to check if the user has unrestricted sudo privileges...

A trace shows that this is how the GUI update is called when you start VMWare Player and it detects a new kernel:

/usr/lib/vmware/bin/vmware-gksu --sudo-mode --message=Please enter your password to proceed. '/usr/bin/vmware-modconfig' --icon='vmware-player' --appname='VMware' --gcc='/usr/bin/gcc' --headers='/lib/modules/3.2.0-27-generic/build/include'  

As you've already tried, even simply adding /usr/bin/vmware-modconfig doesn't work.

We'll assume your spouse's username is guijunkette. The script to manage the VMWare kernel modules is /usr/bin/vmware-modconfig; in light of the note above, it's best to explicitly invoke this from the terminal; to make life easier for your wife, I have included a desktop shortcut so that she needn't even open the terminal.

  1. sudo visudo
  2. Around line 25, below the line %sudo ALL=(ALL:ALL) ALL, insert:

    guijunkette  ALL=(ALL) NOPASSWD: /usr/bin/vmware-modconfig --console --install-all
  3. Exit the editor

To rebuild the modules, she can now run sudo vmware-modconfig --console --install-all without being asked for a password.

Desktop Shortcut

What you can do is create the following desktop file in your wife's ~/Desktop folder, and whenever VMWare Player flashes the "You must..." message, ask her to click Cancel, run this shortcut, and then start VMware Player (successfully) again:

[Desktop Entry]
Name=Update VMWare Modules
GenericName=VMWare Updater
Comment=Update VMWare modules for a new kernel (console mode)
Exec=sudo vmware-modconfig --console --install-all

Paste this into, e.g. /home/guijunkette/Desktop/vmwareupdater.desktop, and remember to chmod +x it.

Here's a demo:

enter image description here

| improve this answer | |
  • I'll give that a try and report back. – GUI Junkie Jul 3 '12 at 23:16
  • I've made the change to the visudo file, even though I can't find the config-tools at /usr/bin/. I'm hoping that file gets created when needed. – GUI Junkie Jul 7 '12 at 9:31
  • @GUIJunkie: Sorry, I made a mistake in giving you the VMWare tools command instead of vmware-modconfig. Please see edits, including the recommended way to invoke a module rebuild. – ish Jul 26 '12 at 18:19
  • I'll try that first thing in the morning :-) – GUI Junkie Jul 26 '12 at 20:42
  • Regarding security, specifying the allowed command-line arguments prevents privilege escalation (for example, by specifying an arbitrary program to run as root with the --gcc flag). But the problem is that you generally only have to build kernel modules when there is a new kernel version. This will work once, but it will never work again. It's necessary instead to allow --headers=... arguments specifying headers in /lib/modules, but not others. I'm not sure sudo can be configured to do this. – Eliah Kagan Jul 26 '12 at 23:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.