-1

I'm trying to give a particular user superuser privileges, specifically the global write permissions that root has. The user in question must have these permissions without using sudo. It's a user that runs a service that is trying to write a file to a directory that it doesn't have write permissions on. I don't know what directory that is, or I would simply change the permissions on it as appropriate. I've tried following the instructions here without success: add new user with root access in Linux. The user in question is elasticsearch. I have the following lines in /etc/sudoers:

root    ALL=(ALL:ALL) ALL
elasticsearch   ALL=(ALL:ALL) ALL # Attempt to give elasticsearch the same permissions as root

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Here is my proof that elasticsearch is a member of the sudo group, but yet still does not have write permissions on /:

[16:22:32][root@pre-staging:/]$ groups elasticsearch
elasticsearch : elasticsearch sudo
[16:22:44][root@pre-staging:/]$ sudo -u elasticsearch touch foo
touch: cannot touch `foo': Permission denied

What am I missing about why elasticsearch doesn't have the write permissions I need it to have?

Community
  • 1
cbmanica
  • 357
  • 2
  • 6
  • 14
  • 5
    `must have these permissions without using sudo.` - then you are wasting your time trying to adjust the sudo configuration. The sudo config only applies if you run the command with sudo. `I don't know what directory that is` - then use something like strace or one of the many other tools to figure out where the application is writing. – Zoredache Jan 25 '13 at 01:45
  • Huh, that other question made it tough to tell that was the case. I didn't realize tools like `strace` existed - that may well solve the problem. Thanks! – cbmanica Jan 25 '13 at 03:40

2 Answers2

3

What am I missing about why elasticsearch doesn't have the write permissions I need it to have?

What you've written in your sudoers file lets you assume root privileges while being the user elasticsearch. What you're doing when you test, though, is changing from the user root to the user elasticsearch.

What you did:

root@pre-staging: sudo -u elasticsearch touch foo

What you should have done:

elasticsearch@pre-staging$ sudo -u root touch foo

... though actually, should you shouldn't do any of that. What you should really do is answer your question about files are touched.

I don't know what directory that is, or I would simply change the permissions on it as appropriate.

There are ways to do that too, and that's probably what you should do. Check out the strace command and use it to trace all the open calls (strace -e trace=open)

Jeff Ferland
  • 20,547
  • 2
  • 62
  • 85
  • Pretty sure he ran `sudo -u elasticsearch touch foo` so he could simulate access as the `elasticsearch` account, which is the correct usage. The disconnect is that he somehow things changing the sudo config is going to change access to the filesystem for that user. – Zoredache Jan 25 '13 at 01:51
  • I did think that, but I guess it isn't that surprising that it isn't true. – cbmanica Jan 25 '13 at 03:38
0

A quick and ugly way to make a user account root would be to edit /etc/passwd and change the users ID to 0. The user ID is the 3rd entry:

root:x:0:0:root:/root:/bin/bash

This is usually not recommended, but it seams that using the normal "Sudo" method is not working out well.

Edit: The user account could also be added to the root group, which should work for file access only.

Also editing /etc/passwrd should be done with care, as typos might be catastrophic.

Badran
  • 21
  • 1
  • 3