Merge lp:~tom-gall/linaro/fix-728674-live-helper.config.natty.alip into lp:~linaro-maintainers/linaro/live-helper.config.natty.alip

[Tom Gall]

Adjust chroot_local-hooks/03-check_sudoers_for_admin.sh to add "%admin ALL = (ALL) NOPASSWD: ALL" to sudoers when it is not yet included in the file. The linaro account is in the admin group so this will make sudo passwordless for linaro just fixing the bug.

Further this script also uses sed to blindly change the %admin line in sudoers which will address the case IF we did not put it there. It does also just redo the change we just did if we are the origin of the %admin line in sudos. BFHD.

[Steve Langasek (vorlon)]

On Sun, Mar 06, 2011 at 08:01:40PM -0000, Tom Gall wrote:
> echo "# Members of the admin group may gain root privileges" >> /etc/sudoers
> - echo "%admin ALL=(ALL) ALL" >> /etc/sudoers
> + echo "%admin ALL = NOPASSWD: ALL" >> /etc/sudoers
> fi

This drops the (ALL) from the existing line. Any reason not to make this

  %admin ALL=(ALL) NOPASSWD: ALL

and keep the runas part here for consistency?

[Tom Gall (tom-gall)]

Good Point. I agree.

review: Needs Fixing

=== modified file 'chroot_local-hooks/03-check_sudoers_for_admin.sh'
--- chroot_local-hooks/03-check_sudoers_for_admin.sh	2010-09-27 10:28:19 +0000
+++ chroot_local-hooks/03-check_sudoers_for_admin.sh	2011-03-07 03:14:53 +0000
@@ -2,9 +2,18 @@
 
 # check to make sure sudoers file has ref for admin
 ADMINEXISTS="$(awk '$1 == "%admin" { print $1 }' /etc/sudoers)"
-if [ "%admin" != "$ADMINEXISTS" ]; then
+if [ -z "$ADMINEXISTS" ]; then
   # append admin entry to sudoers
   echo "# Members of the admin group may gain root privileges" >> /etc/sudoers
-  echo "%admin ALL=(ALL) ALL" >> /etc/sudoers
+  echo "%admin  ALL = (ALL) NOPASSWD: ALL" >> /etc/sudoers
 fi
 
+# make sure that NOPASWD is set for %admin
+# expecially in the case that we didn't add it to /etc/sudoers
+# just blow the %admin ine away and force it to be NOPASSWD
+sed -e '
+/\%admin/ c \
+%admin  ALL = (ALL) NOPASSWD: ALL
+' < /etc/sudoers > /etc/sudoers.tmp
+mv /etc/sudoers.tmp /etc/sudoers
+