Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to give a particular user superuser privileges, specifically the global write permissions that root has. The user in question must have these permissions without using sudo. It's a user that runs a service that is trying to write a file to a directory that it doesn't have write permissions on. I don't know what directory that is, or I would simply change the permissions on it as appropriate. I've tried following the instructions here without success: add new user with root access in Linux. The user in question is elasticsearch. I have the following lines in /etc/sudoers:

root    ALL=(ALL:ALL) ALL
elasticsearch   ALL=(ALL:ALL) ALL # Attempt to give elasticsearch the same permissions as root

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

Here is my proof that elasticsearch is a member of the sudo group, but yet still does not have write permissions on /:

[16:22:32][root@pre-staging:/]$ groups elasticsearch
elasticsearch : elasticsearch sudo
[16:22:44][root@pre-staging:/]$ sudo -u elasticsearch touch foo
touch: cannot touch `foo': Permission denied

What am I missing about why elasticsearch doesn't have the write permissions I need it to have?

share|improve this question
5  
must have these permissions without using sudo. - then you are wasting your time trying to adjust the sudo configuration. The sudo config only applies if you run the command with sudo. I don't know what directory that is - then use something like strace or one of the many other tools to figure out where the application is writing. –  Zoredache Jan 25 '13 at 1:45
    
Huh, that other question made it tough to tell that was the case. I didn't realize tools like strace existed - that may well solve the problem. Thanks! –  cbmanica Jan 25 '13 at 3:40

2 Answers 2

What am I missing about why elasticsearch doesn't have the write permissions I need it to have?

What you've written in your sudoers file lets you assume root privileges while being the user elasticsearch. What you're doing when you test, though, is changing from the user root to the user elasticsearch.

What you did:

root@pre-staging: sudo -u elasticsearch touch foo

What you should have done:

elasticsearch@pre-staging$ sudo -u root touch foo

... though actually, should you shouldn't do any of that. What you should really do is answer your question about files are touched.

I don't know what directory that is, or I would simply change the permissions on it as appropriate.

There are ways to do that too, and that's probably what you should do. Check out the strace command and use it to trace all the open calls (strace -e trace=open)

share|improve this answer
    
Pretty sure he ran sudo -u elasticsearch touch foo so he could simulate access as the elasticsearch account, which is the correct usage. The disconnect is that he somehow things changing the sudo config is going to change access to the filesystem for that user. –  Zoredache Jan 25 '13 at 1:51
    
I did think that, but I guess it isn't that surprising that it isn't true. –  cbmanica Jan 25 '13 at 3:38

A quick and ugly way to make a user account root would be to edit /etc/passwd and change the users ID to 0. The user ID is the 3rd entry:

root:x:0:0:root:/root:/bin/bash

This is usually not recommended, but it seams that using the normal "Sudo" method is not working out well.

Edit: The user account could also be added to the root group, which should work for file access only.

Also editing /etc/passwrd should be done with care, as typos might be catastrophic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.