Software Manager does not give option for sudo/root password

Quick to answer questions about finding your way around Linux Mint as a new user.
Forum rules
There are no such things as "stupid" questions. However if you think your question is a bit stupid, then this is the right place for you to post it. Stick to easy to-the-point questions that you feel people can answer fast. For long and complicated questions use the other forums in the support section.
Before you post read how to get help. Topics in this forum are automatically closed 6 months after creation.
Locked
saivinoba

Software Manager does not give option for sudo/root password

Post by saivinoba »

Hi,
When I'm logged in as a non-default user i.e., other than the one created during install, I'm not able to run Software Manager (mintinstall?). It asks for password but does not accept root password, or sudo password of default account. It says invalid password...try again. If I give password of logged in user, the password window goes away but then nothing happens. The Software Manager GUI does not appear.

If I use 'pkexec mintinstall' it works as I expect. It brings window with option to enter sudo password just like the one we get when trying to change system-wide network settings.

However, I don't want to resort to gksudo, pkexec type commandline methods as the account is family account. I expect, when I click on the software manager icon (as any user), it should ask for sudo password as mentioned above and not logged in user password. How can I get this behaviour?

Thanks in advance.
Last edited by LockBot on Wed Dec 28, 2022 7:16 am, edited 1 time in total.
Reason: Topic automatically closed 6 months after creation. New replies are no longer allowed.
eanfrid

Re: Software Manager does not give option for sudo/root pass

Post by eanfrid »

Hi,
saivinoba wrote:When I'm logged in as a non-default user i.e., other than the one created during install, I'm not able to run Software Manager (mintinstall?). It asks for password but does not accept root password, or sudo password of default account. It says invalid password...try again. If I give password of logged in user, the password window goes away but then nothing happens. The Software Manager GUI does not appear.
this is exactly what is expected when a unauthorized user attempts to run admin commands
saivinoba wrote:If I use 'pkexec mintinstall' it works as I expect. It brings window with option to enter sudo password just like the one we get when trying to change system-wide network settings
pkexec falls back to the root user. Indeed you are typing the root password, because in Mint the main user's password is also setup for the root account for ease of use.
saivinoba wrote:However, I don't want to resort to gksudo, pkexec type commandline methods as the account is family account. I expect, when I click on the software manager icon (as any user), it should ask for sudo password as mentioned above and not logged in user password. How can I get this behaviour?
then all users have to be members of the sudo group with full access. This is not a great idea since so they all can temporarily elevate their privileges to full root privileges (... and nuke the box).
Mute Ant

Re: Software Manager does not give option for sudo/root pass

Post by Mute Ant »

Underneath the pretty icon there's still a GNU command, the ''back-end'' of the launcher. For a system-wide change in behaviour, I would first see what that command is..

Systemwide Launcher...
  • /usr/share/applications/mintInstall.desktop
Actual command therein [LMDE]...
  • Exec=gksu mintinstall
Modified command to force root as the user...
  • Exec=gksu -u root mintinstall
saivinoba

Re: Software Manager does not give option for sudo/root pass

Post by saivinoba »

eanfrid,

I don't think you understood my request correctly. You answered as if the default behaviour is correct and it cannot be(/should not be) changed. Is that right?

I agree that unauthorised user should not be able to run admin commands. What I expect is, there should be prompt to enter sudo/root password, instead of asking user password, only to vanish doing nothing. In that case, why bother showing software manager icon in the menu of non-default (non-sudo) user? Why bother show password prompt?

"pkexec mintinstall" does what I want; it warns that the application I want to run needs superuser previlages and then shows prompt to enter sudo password. I don't want to bother my family with this command line thingie. All I'm asking is, can we get this behaviour when I click on software manager icon. Please note, I'm not even saying this is a bug and things need to be changed upstream etc. I just need a hack to default to my desired behaviour; may be a polkit configuration?

As for sudo, we don't have to put all user in sudo group. We can use aliases (user,cmnd etc) to finetune permissions. I've already made user_alias for my wife's account so that she can install from software manager and change network settings but no other changes. That's why I want the password prompt to ask for sudo password.
saivinoba

Re: Software Manager does not give option for sudo/root pass

Post by saivinoba »

Mute Ant wrote: Systemwide Launcher...
  • /usr/share/applications/mintInstall.desktop
Actual command therein [LMDE]...
  • Exec=gksu mintinstall
Modified command to force root as the user...
  • Exec=gksu -u root mintinstall
Mute Ant, thanks for the tip. But it did not work for me. I tried -u root option in mintInstall.desktop file. The behaviour is as before, it says invalid password (password typed is correct). Ofcourse now it does not allow me to run the command as sudo user and says wrong root password. However, if I type my regular user password the prompt goes away and nothing happens as before.

I then tried changing your command with 'pkexec mintinstall'. It now asks password of my sudo account but when I type password, the prompt goes and nothing happens. Just like it happens with regular account. If I try the same command from terminal, unlike before, I get error

Code: Select all

/usr/lib/python2.7/dist-packages/gtk-2.0/gtk/__init__.py:57: GtkWarning: could not open display
  warnings.warn(str(e), _gtk.Warning)
Traceback (most recent call last):
  File "/usr/lib/linuxmint/mintInstall/mintinstall.py", line 32, in <module>
    from widgets.pathbar2 import NavigationBar
  File "/usr/lib/linuxmint/mintInstall/widgets/pathbar2.py", line 1021, in <module>
    class PathBarThemeHuman:
  File "/usr/lib/linuxmint/mintInstall/widgets/pathbar2.py", line 1034, in PathBarThemeHuman
    animate = gtk.settings_get_default().get_property("gtk-enable-animations")
AttributeError: 'NoneType' object has no attribute 'get_property'
I reverted all my changes and the behaviour is like it was at the start.
Jason246

Re: Software Manager does not give option for sudo/root pass

Post by Jason246 »

saivinoba wrote:Hi,
When I'm logged in as a non-default user i.e., other than the one created during install, I'm not able to run Software Manager (mintinstall?). It asks for password but does not accept root password, or sudo password of default account. It says invalid password...try again. If I give password of logged in user, the password window goes away but then nothing happens. The Software Manager GUI does not appear.

If I use 'pkexec mintinstall' it works as I expect. It brings window with option to enter sudo password just like the one we get when trying to change system-wide network settings.

However, I don't want to resort to gksudo, pkexec type commandline methods as the account is family account. I expect, when I click on the software manager icon (as any user), it should ask for sudo password as mentioned above and not logged in user password. How can I get this behaviour?

Thanks in advance.
I came across this issue a few minutes ago. I simply set a password for the root account then ran mintinstall and it worked.

Code: Select all

sudo passwd root
saivinoba

Re: Software Manager does not give option for sudo/root pass

Post by saivinoba »

Hi all,
I'm reviving an old post of mine. I managed a hack (albeit ugly and may even be bad from security point of view). Software manager (even cinnamon-settings-users), now works as I want.

<rant>
Basically, what I wanted was a "Run As..." feature in software manager (and any program that needs admin privileges). I (we) have a regular (non-sudo) account and would like to work with it full time. I don't want to switch to my sudo account just for installing software or making other changes that require sudo privileges. I don't want to bother my wife with CLI as well. I wanted a prompt in my regular user's session itself where the programs would ask me to select the sudo user and provide that user's password.

This is not new. Update manager behaves this way. However, software manager asks for password (which is basically 'gksu mintinstall'), for which it expects your (currently logged-in user's) password thinking you belong to sudo group; since this currently logged-in user is not in sudoers group, it fails. It's a fail-situation when we are logged in as regular user.

Mute Ant's suggestion was in the right direction. However, when I hit the first hurdle, I gave up. This time, I looked at it again and poked around polkit policies and found a working combination. Here it goes.
</rant>

'pkexec' allows us to run application as another user. So, I changed mintInstall.desktop file's Exec value to 'pkexec mintinstall',

Code: Select all

sai@A4741 ~ $ tail -7 /usr/share/applications/mintInstall.desktop 
Exec=pkexec mintinstall
Icon=/usr/lib/linuxmint/mintInstall/icon.svg
Terminal=false
Type=Application
Encoding=UTF-8
Categories=Application;System;Settings
NotShowIn=KDE;
This alone, will give error as mentioned in my previous post. The solution is to create a polkit policy. I called it 'org.cinnamon.pkexec.policy' and based it on 'com.ubuntu.pkexec.synaptic.policy' (this is the one that Update Manager uses to provide 'select user..' option). Below is my policy file.

Code: Select all

sai@A4741 ~ $ cat /usr/share/polkit-1/actions/org.cinnamon.pkexec.policy 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>

  <action id="org.cinnamon.pkexec.mintinstall">
    <message>Authentication is required to run Software Manager</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/mintinstall</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
  </action>

  <action id="org.cinnamon.pkexec.cinnamon-settings-users">
    <message>Authentication is required to manage Users and Groups</message>
    <defaults>
      <allow_any>auth_admin</allow_any>
      <allow_inactive>auth_admin</allow_inactive>
      <allow_active>auth_admin</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/usr/lib/cinnamon-settings-users/cinnamon-settings-users.py</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
  </action>

</policyconfig>
Now, when I click on software manager icon, I am asked to select (sudo) user, and when I provide password of that user, software manager works as expected.

You may see entry for cinnamon-settings-users in the above policy file. That's because I did similar thing for 'Users and Groups' category in 'Cinnamon Settings' as well. I copied cinnamon-settings-users from /usr/bin to /usr/local/bin

Code: Select all

sudo cp /usr/bin/cinnamon-settings-users /usr/local/bin
Then changed 'gksu' to 'pkexec' under /usr/local/bin, as

Code: Select all

sai@A4741 ~ $ cat /usr/local/bin/cinnamon-settings-users 
#! /usr/bin/python

import os

os.system("pkexec /usr/lib/cinnamon-settings-users/cinnamon-settings-users.py")
This is when you launch 'Users and Groups' from 'Cinnamon Settings'. For menu entry 'Users and Groups' (under Administration), we need to edit cinnamon-settings-users.desktop file as,

Code: Select all

sai@A4741 ~ $ head /usr/share/applications/cinnamon-settings-users.desktop 
[Desktop Entry]
Exec=pkexec /usr/lib/cinnamon-settings-users/cinnamon-settings-users.py
Icon=system-users
Terminal=false
Type=Application
Categories=System;Settings;
StartupNotify=false
OnlyShowIn=X-Cinnamon;
Keywords=Preferences;Settings;
Name=Users and Groups
These two and the policy file entry as above, will give us a 'select user' option to select our sudo users and provide password.

Note: 'pkexec' man page warns us sufficiently not to abuse it (allow_gui option). But I needed the programs to work as I explained above and mentioned hack is the one that currently works. If there are better ways, I will adapt.

Cheers,
Sai

P.S.: When I re-read the post, I felt my reply to eanfrid sounded a bit rude/argumentative. Sorry about that, eanfrid.
niowluka

Re: Software Manager does not give option for sudo/root pass

Post by niowluka »

saivinoba wrote:I (we) have a regular (non-sudo) account and would like to work with it full time. I don't want to switch to my sudo account just for installing software or making other changes that require sudo privileges.
I think you are overcomplicating things here. That's really what sudo is for, so you can live your life as an unprivileged user, and then acquire privileges temporarily by simply running 'sudo', without the need of switching accounts.

Also, you don't need to give yourself or your wife full sudo access, you can just grant access to specific commands in /etc/sudoers file, e.g.:

Code: Select all

saivinoba ALL = (root) /usr/lib/cinnamon-settings-users/cinnamon-settings-users.py
saivinoba

Re: Software Manager does not give option for sudo/root pass

Post by saivinoba »

niowluka wrote:
saivinoba wrote:I (we) have a regular (non-sudo) account and would like to work with it full time. I don't want to switch to my sudo account just for installing software or making other changes that require sudo privileges.
I think you are overcomplicating things here. That's really what sudo is for, so you can live your life as an unprivileged user, and then acquire privileges temporarily by simply running 'sudo', without the need of switching accounts.
As I have mentioned, I don't want to (let my family) use 'sudo' on command line. Wanted graphical option just like it is there for update manager.
niowluka wrote:Also, you don't need to give yourself or your wife full sudo access, you can just grant access to specific commands in /etc/sudoers file, e.g.:

Code: Select all

saivinoba ALL = (root) /usr/lib/cinnamon-settings-users/cinnamon-settings-users.py
I had tried it before without success. After your post, tried again just to be sure. It does not work. The default prompt expects currently logged-in (non-privileged) user's password as 'gksu' works in sudo-mode by default. If I switch gksu to su-mode, giving root (or first created user) password works. That is not what I want. Also, it works if I put the family account (non-privileged user) in the above command which defeats the purpose.
Locked

Return to “Beginner Questions”