8

When I login as guest I am unable to execute any command with sudo.

E.g.:

sudo ps

returns:

sudo: unable to change to sudoers gid: Operation not permitted

How can I fix this?

  • 5
    There is no sense at all in giving everybody the power to manage your system. What is your real goal? – guntbert Oct 20 '13 at 19:16
  • @guntbert I can't recall for exact purpose I needed this for but I do remember trying to do this and failing. So thought I'd ask. A hypothetical use case could be: A guest user is logged in and I/root come over and want to do something(say, copy a specific file from my profile to the guest's desktop) which requires root and sudo seems to be the most convenient way of doing that. – Bleeding Fingers Oct 20 '13 at 19:25
  • 1
    Thats a little far-fetched, isn't it? But in that case you would click on the cog-wheel-icon and select your regular user ... or you could open a virtual terminal. – guntbert Oct 20 '13 at 19:49
10

This is designed as a security feature, really. The "guest" user has a locked down set of permissions and are denied access to sudo, su, and other commands.

If you need to access those commands, you can login as your own user on the TTY, through Ctrl+Alt+F1 or any of the other F# keys up to 6, and login through that, however guest user is locked out of the administrative commands and such.

  • could you please elaborate "can't access"? – Bleeding Fingers Oct 20 '13 at 19:26
  • @hus787 reworded it. – Thomas Ward Oct 20 '13 at 19:27
  • or more precisely "access"? – Bleeding Fingers Oct 20 '13 at 19:28
  • 1
    @hus787 you can look up the definition of the word "access" yourself, next time, its definition is universal. From merriam webster dictionary though: "permission or the right to ... make use of something" Basically, the guest user sessions are not permitted to utilize commands such as sudo or su. – Thomas Ward Oct 20 '13 at 19:30
  • duh. The point of me asking you to elaborate is the fact that, I think, guest session has access to both sudo and su or I would have got something akin to No command...found, but that's not what I get, instead I get Operation not permitted, setgid:.. – Bleeding Fingers Oct 20 '13 at 19:35
2

I recommend against all the solutions here, again for security reasons. In the use-case outlined by the op in his response:

A guest user is logged in and I/root come over and want to do something(say, copy a specific file from my profile to the guest's desktop) which requires root and sudo seems to be the most convenient way of doing that.

The most convenient way of doing this is to execute su [your username]. By default root has no password and you can't use that username, so use your regular admin account. You will then be prompted for your password. You can then execute what commands you wish, perhaps prepending them with sudo, typing your password again. When you are finished using your own account's permissions, type exit and they will be returned to their own prompt.

  • You'll notice I don't give them a solution ;) – Thomas Ward Jan 3 '14 at 6:05
2

It is every easy to do administrative tasks from a guest session. The su is disabled, but they cannot disable ssh.

All you have to do is ssh into an account in the sudoers list on localhost:

ssh <username>@localhost

where <username> is that of the account.

1

The guest user in Ubuntu is a generated user every time you log in with guest. See:

guest-5VczkW@host:~$ grep guest /etc/passwd
guest-5VczkW:x:115:125:Guest,,,:/tmp/guest-5VczkW:/bin/bash

The name guest-5VczkW is changing with every guest session. The script that generates this user is the a script called guest-account:

which guest-account
/usr/sbin/guest-account

Now you can edit this sciript by adding the guest user to a sudo group. So every new generated guest user is added to this group that has the right to gain root-privileges.

But, I can't recommend this intrusion into the system. It's a major security risk. In your situation I would just make a new normal user called "guest" with a password that everyone knows, and add this user to the sudo group. But notice, even with this solution everyone that known the guest login can change the system significantly.

  • 2
    I'm downvoting this answer for the sole reason of preventing a security risk, your answer does provide an answer, however it opens up a pretty large security hole. (which is the ONLY reason I'm downvoting it) – Thomas Ward Oct 20 '13 at 19:33
  • 2
    And I mentioned in my answer with bold text that it's a security risk, and I wouldn't recommend it. – chaos Oct 20 '13 at 19:44
  • Use, bigger, bolder, scarier text. "FOR EDUCATIONAL PURPOSES ONLY. DO NOT DO THIS. IT IS BAD. ZOMBIE NINJAS WILL KILL YOU IN YOUR SLEEP." – user3113723 Jul 10 '15 at 22:22
1

Rather than trying to fix it, consider creating a second user with sudo privileges. Hopefully this is straighforward to do via the unity ui, since I only know how to do it by editing /etc/sudoers. That way, "guest" remains unpriviliged like it's supposed to be, and you can make the second user as secure or insecure as you like.

Not the answer you're looking for? Browse other questions tagged or ask your own question.