During an installation, as usual, we create our main user account, and then we can do sudo commands with it without problem. Now, when I created another account, and I wanted to do sudo, it gave me error that the account is not in the sudoers file. In that file I found out that users in %admin and %sudo groups can gain root privileges. But my main account is not in neither one of those groups and I can do sudo with it without problem, but with the other account I can't. Is there something besides sudoers that I should know about? Thanks
The admin and sudoer groups should give the user the access needed. You will have to log the user out and back in again for the changes to take effect. Have a look at these answers for some pretty good instructions:
How can I create an administrator user from the command line?
No, I already logged out and in. Read my question carefully. I am asking how does the system give one user administrative permissions even though he is not in the sudoers, nor in the group which is in sudoers– dacSep 30, 2012 at 2:49
To answer the general question some programs use mechanisms that use polkit to screen for root privileges rather than using the
/etc/sudoers approach. (For example, gparted, as I recall). The
sudo command uses
/etc/sudoers.d/* so be sure to check each file. LDAP can conceivably be used to source information, by the way.
My system is 12.04 and my sudo-capable accounts are in the
sudo group. My pertinent polkit files are
/etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf. Yours may be different.
I assume you realize that if the sudoers file says
%sudo that means user must be in the
sudo group. I assume, but don't know, that a long lasting credential might persist after a policy (or group) change. I would think you would know if this had been done, however.
To pursue further I suggest that you post the contents of the
/etc/sudoers and the files in
/etc/sudoers.d/ and under the tree
/etc/polkit-1/ and tell us what groups the two userids are added to. I don't believe there are any passwords or hashes in the files I'm mentioning.
To be pedantic, polkit does not dispense root privileges, rather, it confirms whether a user is authorised to perform an action. A system D-Bus service must already have root privileges.– FlimmDec 5, 2012 at 23:24
@Flimm, I've edited to reword this section. Thanks for the comment. Dec 9, 2012 at 17:17
Well, I had a look at the source code for
gparted-pkexec, and discovered
pkexec, which acts like
sudo, but uses PolicyKit to check if the user has
org.freedesktop.policykit.execauthorisation, or a specific authorisation for that specific binary. So PolicyKit may not dispense root privileges, but
pkexecdoes! I learned something today!– FlimmDec 9, 2012 at 21:37