Bug 2045508

Summary:	RFE: Allow created user to sudo without password
Product:	Red Hat Enterprise Linux 8	Reporter:	Marko Myllynen <myllynen>
Component:	osbuild-composer	Assignee:	Image Builder team <osbuilders>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Release Test Team <release-test-team>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.5	CC:	obudai, thozza
Target Milestone:	rc	Keywords:	FutureFeature, RFE, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-27 13:28:15 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marko Myllynen 2022-01-25 16:52:43 UTC

Description of problem:
Image Builder allows creating user and adding it to the wheel group which in turn allows the user to become root (sudo su -).

Currently there seems to be no way to allow a created user to become root without providing the user's password. Using automation tools such as Ansible is more feasible with setup and doesn't force users to do it for each system afterwards.

Version-Release number of selected component (if applicable):
RHEL 8.5

Comment 2 Ondřej Budai 2022-03-01 12:21:55 UTC

Hello Tom,

we have this in our EC2 images, right? What about other images? Was there some kind of consensus on how we should handle this?

Thanks!

Comment 3 Tomáš Hozza 2022-05-03 07:05:58 UTC

(In reply to Ondřej Budai from comment #2)
> Hello Tom,
> 
> we have this in our EC2 images, right? What about other images? Was there
> some kind of consensus on how we should handle this?

The password-less sudo for the default user in EC2 images is configured by cloud-init. AFAIK, we currently don't have any way to achieve this for custom users. There were some discussions about this in the past, but no real consensus or agreement. Nevertheless there is definitely a demand to allow this in composer / image-builder.

Comment 5 Ondřej Budai 2023-06-27 13:11:30 UTC

Since 8.8/9.2, this can be achieved via the custom files customization:

[[customizations.files]]
path = "/etc/sudoers.d/wheel-passwordless-sudo"
mode = "0400"
data = """
%wheel	ALL=(ALL)	NOPASSWD: ALL
"""

Marko, would that work for you?

Comment 6 Marko Myllynen 2023-06-27 13:18:06 UTC

Yes, that looks reasonable, thanks!