1

During an installation, as usual, we create our main user account, and then we can do sudo commands with it without problem. Now, when I created another account, and I wanted to do sudo, it gave me error that the account is not in the sudoers file. In that file I found out that users in %admin and %sudo groups can gain root privileges. But my main account is not in neither one of those groups and I can do sudo with it without problem, but with the other account I can't. Is there something besides sudoers that I should know about? Thanks

Improve this question

2 Answers 2

Reset to default
1

The admin and sudoer groups should give the user the access needed. You will have to log the user out and back in again for the changes to take effect. Have a look at these answers for some pretty good instructions:

How can I create an administrator user from the command line?

Improve this answer
1
  • No, I already logged out and in. Read my question carefully. I am asking how does the system give one user administrative permissions even though he is not in the sudoers, nor in the group which is in sudoers
    – dac
    Sep 30, 2012 at 2:49
1

To answer the general question some programs use mechanisms that use polkit to screen for root privileges rather than using the /etc/sudoers approach. (For example, gparted, as I recall). The sudo command uses /etc/sudo and/etc/sudoers.d/* so be sure to check each file. LDAP can conceivably be used to source information, by the way.

My system is 12.04 and my sudo-capable accounts are in the sudo group. My pertinent polkit files are /etc/polkit-1/localauthority.conf.d/50-localauthority.conf and /etc/polkit-1/localauthority.conf.d/51-ubuntu-admin.conf. Yours may be different.

I assume you realize that if the sudoers file says %sudo that means user must be in the sudo group. I assume, but don't know, that a long lasting credential might persist after a policy (or group) change. I would think you would know if this had been done, however.

To pursue further I suggest that you post the contents of the /etc/sudoers and the files in /etc/sudoers.d/ and under the tree /etc/polkit-1/ and tell us what groups the two userids are added to. I don't believe there are any passwords or hashes in the files I'm mentioning.

Improve this answer
3
  • To be pedantic, polkit does not dispense root privileges, rather, it confirms whether a user is authorised to perform an action. A system D-Bus service must already have root privileges.
    – Flimm
    Dec 5, 2012 at 23:24
  • @Flimm, I've edited to reword this section. Thanks for the comment.
    – John S Gruber
    Dec 9, 2012 at 17:17
  • Well, I had a look at the source code for gparted-pkexec, and discovered pkexec, which acts like sudo, but uses PolicyKit to check if the user has org.freedesktop.policykit.exec authorisation, or a specific authorisation for that specific binary. So PolicyKit may not dispense root privileges, but pkexec does! I learned something today!
    – Flimm
    Dec 9, 2012 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.