4

The Problem

Am trying allow a specific user, who is in the group sudo, to perform an emergency shutdown using the following code:

echo 1 > /proc/sys/kernel/sysrq
echo o > /proc/sysrq-trigger

Note, this is without using the command sudo!

EDIT: Forgot to mention that both files, owned by root:root, refuse to allow any permission or owner changes, even by the root user.

Theoretical Scenario

A hacker compromises a system, which is usually left to run without supervision, and gained permissions to read confidential data. Rather than allowing the hacker to continue, an automated script powers off the machine (assume that the hack has been detected).

While not my exact use case, it is similar enough.

What I Have Tried

  • Creating a bash script to perform the above 2 lines of code, giving it root:sudo owners, and adding a line to visudo to allow the specific user to run the task without needing to enter the password.

  • Attempted to change the owner of the 2 files to root:sudo.

  • Attempted to change the permissions of the 2 files such that the group root could write to them.

The idea is to not "bake in" the password for sudo, which will allow me to change is regularly without forgetting to modify other files (or to have the process which turns off the computer running with root privileges). Thanks in advance for your help.

1 Answer 1

2

My opinion is to change your lines into something like this in your script:

echo 1 | sudo tee /proc/sys/kernel/sysrq > /dev/null
echo o | sudo tee /proc/sysrq-trigger > /dev/null

And give the specific user access to run tee command with these arguments without the need of entering password, something like:

username ALL=(root:root) NOPASSWD: /usr/bin/tee /proc/sys/kernel/sysrq

Remember that it's not possible to redirect an string into a file which needs a specific permission using >, it means something like:

sudo echo hi > file
echo hi sudo >  file

is not going to work.

At the same time you can't simply change the owner of these files, cause /proc is a virtual file system managed by Kernel.

1
  • Thanks for your quick response! Works like a charm. Did not know about the limitation with echo, so thanks for explaining that to me as well =) Jun 19, 2017 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.