3

I have a user chrooted to a directory, and everything is working smoothly. I want a group this user is in to be able to restart a single process that's being managed by supervisor, however, and I can't figure out how.

I've added this line to /etc/sudoers:

%mygroupname ALL = (root) NOPASSWD:/usr/bin/supervisorctl restart myprocessname

I copied /usr/bin/sudo to the same path in the chroot environment. I also copied all of its dependencies to the relevant places (found using ldd /usr/bin/sudo).

I've gathered that sudo uses a ton of additional files on the system, and I've copied them to the chroot environment. I'm stuck now, however, and can't get past this error. What am I missing?

sudo log (line breaks for readability):

Nov 10 20:29:04 sudo[3593] pam_setcred: Failure setting user credentials @
                           sudo_pam_begin_session()
                           /build/sudo-1bDJzQ/sudo-1.8.16/plugins/sudoers/auth/pam.c:274

Nov 10 20:29:04 sudo[3593] pam_open_session: Module is unknown @
                           sudo_pam_begin_session()
                           /build/sudo-1bDJzQ/sudo-1.8.16/plugins/sudoers/auth/pam.c:283

Is this a completely stupid idea in the first place?

6
+50

Rather than trying to copy the sudo binary and its dependencies into the chroot, it might be easier to have a script running as root that checks when a file exists and restarts the process.

That script might be something like this:

#!/bin/bash
restartfile="restartprocess"
while :
do
   for user in /home/*
   do
      if [ -f $user/$restartfile ]
      then
         supervisorctl restart myprocessname
         rm $user/$restartfile
      fi
   done
   sleep 5 #Adjust file checking time interval
done

(This also assumes the user is chrooted to a folder in /home)

Once this script is running as root, the chrooted user would just have to run one of the following commands to create an empty file (called restartprocess) in its home directory (you could add ~/ before the file name):

touch restartprocess
echo > restartprocess
> restartprocess

And the process would be restarted.

| improve this answer | |
  • Oh this is beautiful, I never would have thought of this. Thank you so much, it works perfectly! – vaindil Nov 13 '16 at 18:34
  • No problem, glad it helped! – Evan Chen Nov 13 '16 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.