search

LukeSmithxyz / LARBS

Luke's Auto-Rice Bootstrapping Scripts: Installation Scripts for My Arch Linux Meta-Distribution
GNU General Public License v3.0
2.06k stars 800 forks source link

Fresh Install leaves Sudo commands open without password #517

Closed kronikpillow closed 4 months ago

kronikpillow commented 1 year ago

upon fresh install, any sudo command can be executed without password due to the LARBS installer leaving a residual file left inside of /etc/sudoers.d from the installer self, that is meant to be temporary named /etc/sudoers.d/larbs-temp ...

im sure this isn't the intended behavior and that who ever added that line, forgot to add a line that removes it after installation is complete :)

LukeSmithxyz commented 1 year ago

The line right above the line that creates the file traps a removal command for it. Did your script end in an unexpected way?

kronikpillow commented 1 year ago

Nope, it ended perfectly to the end, with all packages installed, except that the temp permissions didnt get removed, all 4 attempts this week ... Aka 4 reinstalls, same result

exlumine commented 1 year ago

upon fresh install, any sudo command can be executed without password due to the LARBS installer leaving a residual file left inside of /etc/sudoers.d from the installer self, that is meant to be temporary named /etc/sudoers.d/larbs-temp ...

Same here, I made a fresh install with larbs.sh around a week ago. sudo does not ask for my password.

exlumine commented 1 year ago

So deleting /etc/sudoers.d/larbs-temp leads back to normal behavior.

kronikpillow commented 1 year ago

yeah I confirm this issue still exists even after a fresh install

kronikpillow commented 1 year ago

months later ... this issue still exists and leaves passwordless su and sudo access to users

NicholasasaurusRex commented 1 year ago

I do this after a fresh install:

su groupadd sudo usermod -aG sudo $USER rm /etc/sudoers.d/larbs-temp exit

And you then have normal sudo function.

I have a script I run after installing LARBS to make even more changes after a fresh install to make these small changes. This probably should be fixed as it's kind of a security fix. I'd recommend turning those command above into a small script and run it after an install.