Bug 2045508 - RFE: Allow created user to sudo without password
Summary: RFE: Allow created user to sudo without password
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: osbuild-composer
Version: 8.5
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Image Builder team
QA Contact: Release Test Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-01-25 16:52 UTC by Marko Myllynen
Modified: 2023-06-27 13:28 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-06-27 13:28:15 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-109642 0 None None None 2022-01-25 17:53:44 UTC

Description Marko Myllynen 2022-01-25 16:52:43 UTC
Description of problem:
Image Builder allows creating user and adding it to the wheel group which in turn allows the user to become root (sudo su -).

Currently there seems to be no way to allow a created user to become root without providing the user's password. Using automation tools such as Ansible is more feasible with setup and doesn't force users to do it for each system afterwards.

Version-Release number of selected component (if applicable):
RHEL 8.5

Comment 2 Ondřej Budai 2022-03-01 12:21:55 UTC
Hello Tom,

we have this in our EC2 images, right? What about other images? Was there some kind of consensus on how we should handle this?

Thanks!

Comment 3 Tomáš Hozza 2022-05-03 07:05:58 UTC
(In reply to Ondřej Budai from comment #2)
> Hello Tom,
> 
> we have this in our EC2 images, right? What about other images? Was there
> some kind of consensus on how we should handle this?

The password-less sudo for the default user in EC2 images is configured by cloud-init. AFAIK, we currently don't have any way to achieve this for custom users. There were some discussions about this in the past, but no real consensus or agreement. Nevertheless there is definitely a demand to allow this in composer / image-builder.

Comment 5 Ondřej Budai 2023-06-27 13:11:30 UTC
Since 8.8/9.2, this can be achieved via the custom files customization:

[[customizations.files]]
path = "/etc/sudoers.d/wheel-passwordless-sudo"
mode = "0400"
data = """
%wheel	ALL=(ALL)	NOPASSWD: ALL
"""

Marko, would that work for you?

Comment 6 Marko Myllynen 2023-06-27 13:18:06 UTC
Yes, that looks reasonable, thanks!


Note You need to log in before you can comment on or make changes to this bug.