Yocto Jethro: how do I add user to sudoers list - yocto

I added a new user as follows
inherit extrausers
EXTRA_USERS_PARAMS = "useradd -P p#ssW0rd user1;"
I am trying to find how to add users to sudoers list. Is there a class like extrausers
Update-1:
In class classes/extrausers.bbclass I see usermod supported. Will the following work?
inherit extrausers
EXTRA_USERS_PARAMS = "useradd -P p#ssW0rd user1;\
usermod -aG sudo user1"
Update-2:
I tried adding IMAGE_INSTALL_append += " sudo " and
inherit extrausers
EXTRA_USERS_PARAMS = "useradd -P foobar -G sudo user1;"
But that does not help me in achieving the effect of adding user1 to sudoers list. I see following error when I do sudo -v
Sorry, user user1 may not run sudo on <machine-name>.
Update-3:
I found that the sudoers file has the sudo group commented as follows:
# %sudo ALL=(ALL) ALL
Hence the reason even adding user1 to group sudo didn't help
Rather than adding user1 to group sudo I adopted approach of adding a drop-in file under /etc/sudoers.d/0001_user1 using recipes-extended/sudo/sudo_1.8.14p3.bbappend
do_install_append () {
echo "user1 ALL=(ALL) ALL" > ${D}${sysconfdir}/sudoers.d/001_first
}
Now I need help in understanding which of following is a better approach in terms of security?
uncomment sudo line in /etc/sudoers and adding user1 to /etc/sudoers
adding user1 in /etc/sudoers.d/001_first

So there are two approaches to add an user with sudo capability
Add user to sudo group and enable sudo group in /etc/sudoers
Create a file under ${D}${sysconfdir}/sudoers.d/ and add the sudo rule for user there.
Now which approach is suitable for your distro is well answered in /etc/sudoers vs /etc/sudoers.d/ file for enabling sudo for a user

Related

VS Code Remote-Containers: cannot create directory ‘/home/appuser’:

I'm trying to use the Remote - Containers extension for Visual Studio Code, but when I "Open Folder in Container", I get this error:
Run: docker exec 0d0c1eac6f38b81566757786f853d6f6a4f3a836c15ca7ed3a3aaf29b9faab14 /bin/sh -c set -o noclobber ; mkdir -p '/home/appuser/.vscode-server/data/Machine' && { > '/home/appuser/.vscode-server/data/Machine/.writeMachineSettingsMarker' ; } 2> /dev/null
mkdir: cannot create directory ‘/home/appuser’: Permission denied
My Dockerfile uses:
FROM python:3.7-slim
...
RUN useradd -ms /bin/bash appuser
USER appuser
I've also tried:
RUN adduser -D appuser
RUN groupadd -g 999 appuser && \
useradd -r -u 999 -g appuser appuser
USER appuser
Both of these work if I build them directly. How do I get this to work?
What works for me is to create a non-root user in my Dockerfile and then configure the VS Code dev container to use that user.
Step 1. Create the non-root user in your Docker image
ARG USER_ID=1000
ARG GROUP_ID=1000
RUN groupadd --system --gid ${GROUP_ID} MY_GROUP && \
useradd --system --uid ${USER_ID} --gid MY_GROUP --home /home/MY_USER --shell /sbin/nologin MY_USER
Step 2. Configure .devcontainer/devcontainer.json file in the root of your project (should be created when you start remote dev)
"remoteUser": "MY_USER" <-- this is the setting you want to update
If you use docker compose, it's possible to configure VS Code to run the entire container as the non-root user by configuring .devcontainer/docker-compose.yml, but I've been happy with the process described above so I haven't experimented further.
You might get some additional insight by reading through the VS Code docs on this topic.
go into your WSL2 and check what is your local uid (non-root) using command id.
in my case it is UID=1000(ubuntu).
Change your dockerfile, to something like this:
# For more information, please refer to https://aka.ms/vscode-docker-python
FROM python:3.8-slim-buster
# Keeps Python from generating .pyc files in the container
ENV PYTHONDONTWRITEBYTECODE=1
# Turns off buffering for easier container logging
ENV PYTHONUNBUFFERED=1
# Install pip requirements
COPY requirements.txt .
RUN python -m pip install -r requirements.txt
WORKDIR /home/ubuntu
COPY . /home/ubuntu
# Creates a non-root user and adds permission to access the /app folder
# For more info, please refer to https://aka.ms/vscode-docker-python-configure-containers
RUN useradd -u 1000 ubuntu && chown -R ubuntu /home/ubuntu
USER ubuntu
# During debugging, this entry point will be overridden. For more information, please refer to https://aka.ms/vscode-docker-python-debug
CMD ["python", "app.py"]

Yocto Warrior Cannot Set Password for root or other users

I am using the meta-tegra warrior branch layer to build an sd card image for the Nvidia Jetson Nano. The image completes and the board boots, but I cannot log in if I try to set any kind of password in Yocto. I've tried creating users other than root and setting their passwords, but the same problem occurs where I cannot log in.
If I leave "debug-tweaks" enabled, and do not attempt to modify the root password at all, I can successfully log in without a password.
I am using warrior branch for OE and haven't modified other layers. How can I set a password for root?
Here are my local.conf password related lines:
# Password Stuff
INHERIT += "extrausers"
#EXTRA_IMAGE_FEATURES = "debug-tweaks"
EXTRA_USERS_PARAMS = "usermod -P mypassword123 root; "
EXTRA_USERS_PARAMS = " useradd testing; \
useradd mts; \
usermod -p 'testing12345' testing; \
usermod -p 'comp12345' comp; \
usermod with -p (minus p) needs a hash generated from openssl passwd command so you need to set Yocto variable as following:
EXTRA_USERS_PARAMS = "usermod -p $(openssl passwd <some_password>) root;"
If you want to append something to bitbake variable, you need to use _append or += operators, ie:
EXTRA_USERS_PARAMS_append = " useradd testing;"
EXTRA_USERS_PARAMS_append = " useradd mts;"
...

YoctoProject: change ownership of all files in a recipe

For the YoctoProject (v2.0, Jethro) the ownership of files inside the image defaults to user and group root unless I do explicitly change them by chown and chgrp in the do_install step for the given recipe.
I have a few recipes for which all files should be owned by another group and user than root. Is there a (cleaner/smarter) way to achieve this without calling chown and chgrp in do_install?
BSP vendors do usually provide example recipes to solve basic tasks.
Usually folder is called "recipes-skeleton"
User/Group add recipe sample path for freescale BSP:
~/yocto/fsl-community-bsp/sources/poky/meta-skeleton/recipes-skeleton/useradd/useradd-example.bb
Same can be found on github:
https://github.com/dirtybit/gumstix-yocto/blob/master/meta-skeleton/recipes-skeleton/useradd/useradd-example.bb
For changing root user info look up EXTRA_USERS_PARAMS flag. Need to inherit "extrausers" class first. Documentation on class is at:
http://www.yoctoproject.org/docs/current/mega-manual/mega-manual.html#ref-classes-extrausers
You can easily add user adding the following to your recipe.
inherit extrausers
EXTRA_USERS_PARAMS = " useradd user1; \
useradd user2; \
useradd user3; \
usermod -p 'user1_psw' user1; \
usermod -p 'user2_psw' user2; \
usermod -p 'user3_psw' user3;\
usermod -a -G sudo user1; \
usermod -a -G sudo user2; \
usermod -a -G sudo user3; "

Yocto/Poky sudo not working

In my poky build, I've added a password for root, and also I've added a user "myuser". In addition I've added sudo to the list of IMAGE_INSTALL_append.
When logging as "myuser" and tried to "sudo chmod" a file using the root password, it doesn't work "Sorry try again"...
I can log in normally as root with my password,
Anyone has seen this, is sudo working for poky?
As sudo can be executed an you've got a Sorry try again.. error message I think you either got your password wrong (make sure you use the users password, not roots) or you haven't configured sudo correctly.
For a description on how to use /etc/sudoers take a look at its manpage: https://linux.die.net/man/5/sudoers
No way. There is no su package in Yocto/OE.
Does your image build ? You should have had something like Missing or unbuildable dependency chain error, unless you've created a recipe providing su package.
To add user with sudo capability, below is an example of what you should have in your image's recipe.
Create the user with a suitable password
Add the user to sudo group
Give sudo capabilities to sudo members
I suppose you have an image recipe, or even a bbappend on an existing one.
IMAGE_INSTALL_append = " sudo"
inherit extrausers
PASSWORD = "mypassword"
USER = "myuser"
EXTRA_USERS_PARAMS = "\
useradd -p `openssl passwd ${PASSWORD}` ${USER}; \
usermod -a -G sudo ${USER}; \
"
# Here we give sudo access to sudo members
update_sudoers(){
sed -i 's/# %sudo/%sudo/' ${IMAGE_ROOTFS}/etc/sudoers
}
ROOTFS_POSTPROCESS_COMMAND += "update_sudoers;"
Problem fixed removing "sudo" from IMAGE_INSTALL_append, and just using "su" instead

sudo -l for a different as root

Hi all am trying list all the sudo command a user has access to as a root , obviously we can see that in sudoers file but if there are a lot of user/command aliases it becomes difficult
i am trying to do sudo -l for a different user as root
i have tried using -u option
sudo -u testuser -l
throws command usage message
sudo -u testuser sudo -l
prompts for testuser's password (i dont want password prompt as i am doing as root)
su - testuser -c 'sudo -l'
gives me below error
sudo: no tty present and no askpass program specified
please let me know how to go about this
As per man sudo:
-U user, --other-user=user
Used in conjunction with the -l option to list the privileges
for user instead of for the invoking user. The security pol-
icy may restrict listing other users' privileges. The
sudoers policy only allows root or a user with the ALL privi-
lege on the current host to use this option.
you're using -u, which is something completely different:
-u user, --user=user
Run the command as a user other than the default target user
(usually root ). The user may be either a user name or a
numeric user ID (UID) prefixed with the '#' character etc...