Ah yes, that blue hint,
suggesting that we're about to dive out to our command line. And we're
going to be taking a look at the default Policy kit rules,
we'll be using the command line utilities,
pkttyagent and pkexec, seeing where they fit in, and we can take a
look at recovering from a failed sudo system.
Although I do point out, we are deliberately breaking our system here
and hopefully going to be able to recover from it, but if you feel that
your system has a level of importance to it,
then it's your judgment call whether or not you run through this exercise.
Ah yes, back on our command line, and let's take a
look at some of our policy kit tools.
The first thing we can take a look at is pkaction.
This then lists all of the actions that are available to me to set in rules,
and these rules then govern as to who can do what using the policy kit system,
or Polkit, as it's now more commonly known as. If I go through, and just using
our sudo command, take a look at our etc/polkit‑1, the subdirectory, rules.d,
and on Enterprise Linux, so AlmaLinux 8 and other derivatives, we can go
through and look at the 50‑default.rules file, and it contains a single rule in
here that's an admin rule saying that we're allowed to run anything so long as
we're a member of the wheel group. Now we are a member of the group, I have
made sure that my vagrant account is already a member of our wheel group, and
we can see there that I belong to the group 10(wheel).
If you're working on a different distribution, then you need to match
the group membership with the main admin group on that distribution,
such as the sudo group. With this done and dusted, I've got a
password, we need to have a password for our account to authenticate
through to the policy kit.
We can go through and see how we can run this, but we need to understand that
we need a remote authenticator to look at our processes. So I need to get the
process ID of my current shell, the shell that I'm going to execute the
policy kit commands from, so it's 4288.
Let's see if I can remember that and move to a second window that I
have opened, and we run the remote authenticator,
the pkttyagent, looking at process ID 4288.
We can check that is the correct ID, and if we return to that second
window, we can see the program maintains then the connection to the shell
looking for authentication requests. With that done and dusted, we can go
ahead and see how this will work.
Instead of using our su or our sudo command, we use pkexec policy kit
exec, and let's go through and try and cat out our etc and shadow file,
we know this is a restricted file. Now, I'm not getting any closer, so I
have to move to my authenticator, put in my password,
we get the AUTHENTICATION COMPLETE, so it has worked, and you can
see now that the command has run. So this is good, but, it's a
little bit complex, and why would I use it?
Well to recover from accidental damage to your sudo system.
I've been telling you that we have to use visudo, but if we answer those
questions incorrectly, we break the sudoers system.
Let me show you, but also let me give you a severe warning that you
shouldn't be doing this on any machine that you value.
If it doesn't work, you've broken your system.
So I'm going to go through now and make an edit
through to my standard sudoers file.
I can move down to where I've got my entry for my bob account, we can see
it's opened up in nano, and I can go through to my bob account and I can
make some kind of syntactical error. Here, I've removed the equals symbol.
Again, I can't stress how bad this is.
We go through and save it, we look at the questions,
we panic,
we start sweating, and we just think, oh quit, get out of here, we don't read
that word, DANGER. Quit isn't what we want to do, but that's what we've
typed. Ah, that's okay, nothing, oh my goodness. I go back and run it, and
look at this, my sudoer system is broken.
I cannot gain administrative rights to fix this.
I thought it might have been okay, it all seemed okay, but no, it's not.
Literally, the system is broken. But, pkexec can go and save me.
Look at this, pkexec visudo. So waiting for the
authentication let's me move to the authenticator.
Well let me show you what happens if I put a wrong password in.
So if I go through and put a wrong password in, it tries to
authenticate me, but authentication fails.
If I return back to the calling machine, it shows me, no, we're not
allowed to run it, but if I go through and run pkexec visudo again, and
this time, we'll authenticate correctly, we've got our authentication
complete. And now, we can see that we're editing the file. Again, it
bypasses the environment variable so we're back opening it up in vi, but
I can then move down, correct the entry for bob,
put the equals back in, go through,
save the changes, and now as I go through and try the visudo again
with sudo, we're all back up and running. So we can see how useful
this can be. Even though it seems clunky,
it works better with a desktop operating system, but is essential on our servers as well if we do make errors to the sudo system.