0

I got this line in sudoers:

Cmnd_Alias NVIDIA = /sbin/sh -c 'echo ON > /proc/acpi/bbswitch; modprobe nvidia; modprobe nvidia_drm modeset=1' user ALL=(ALL) ALL, NOPASSWD: /sbin/systemctl suspend,NVIDIA 

My sudo -l shows me:

sudo -l User user may run the following commands on devbox: (ALL) ALL, NOPASSWD: /sbin/systemctl suspend, /sbin/sh -c 'echo ON > /proc/acpi/bbswitch; modprobe nvidia; modprobe nvidia_drm modeset\=1' 

Nevertheless if I try to run /sbin/sh -c 'echo ON > /proc/acpi/bbswitch; modprobe nvidia; modprobe nvidia_drm modeset=1' - I am still prompted to enter password.

I suspect there's something about = sign I have in the modeset argument for nvidia load?

1 Answer 1

4

First off, make sure you always use visudo to edit /etc/sudoers. It will perform syntax checks for you so that it's less likely you end up shutting yourself out.

Now, use that command to remove the inappropriate first comma (between ALL and NOPASSWD):

(ALL) ALL NOPASSWD: /sbin/systemctl suspend 

Next, know that your modeset command is too complex to define directly and reliably in the sudoers file. Consider this command (with or without sudo):

sh -c 'date >/tmp/date' 

The quotes will be parsed by your own (interactive) shell and the quoted string passed as a single word. The sh will see two arguments, -c and date >/tmp/date; the quotes are never seen by the command. Similarly, the quotes here will never be seen by sudo either:

sudo sh -c 'date >/tmp/date' 

The sudo will see three arguments sh, -c, and date >/tmp/date.

Therefore my suggestion would be that you create a short shell script that performs the required action, and add that to your sudoers file. (Run the following block of commands as root - use sudo -s to get a root shell.)

cat >/usr/local/bin/modeset1 <<EOF #!/bin/sh echo ON > /proc/acpi/bbswitch modprobe nvidia modprobe nvidia_drm modeset=1 EOF chown root /usr/local/bin/modeset1 chmod a=rx,u+w /usr/local/bin/modeset1 

Now add this line to sudoers using the visudo command:

(ALL) ALL NOPASSWD: /usr/local/bin/modeset1 

Once /usr/local/bin has been added to your $PATH you just invoke it with your usual user account as a standard command,

sudo modeset1 
1
  • Thanks, this is what I ended up doing, looks like passing arguments to sudo is tricky, so setting up a shell script and referencing it in the sudoers works fine. Commented Jan 22, 2024 at 14:05

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.