Lua Script with os.execute("sudo ...") does not work due to sudo "no new privileges"

[jdr85]

Hi,

since I don't know when I cannot shutdown my system with Lua scripts any more.

My shutdown Lua script:

-- {"order":1,"arguments":[]}
-- /var/lib/mympd/scripts - mympd:mympd - 0700
os.execute("sudo /sbin/poweroff")

The script is executed but in my systemd journal, I get the following error:

Dez 04 10:15:29 jdr-musibert mympd[16113]: sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
Dez 04 10:15:29 jdr-musibert mympd[16113]: sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

This is probably not a mympd issue, but maybe somebody has an idea what to do.

Server plattform:

• OS: Raspbian GNU/Linux
• OS version: bookworm/sid
• Plattform: armv6l (Raspberry Pi 1B)
• MPD version: 10.1.3

[jcorporation]

This seems to be a regression with the new hardend systemd service unit.

Try:

mkdir /etc/systemd/system/mympd.service.d
echo -e '[Service]\nNoNewPrivileges=no' > /etc/systemd/system/mympd.service.d/no-new-privileges.conf

[jdr85]

Hi Jürgen,

unfortunately, it does not work - still the same error message.
After reading here that the NoNewPrivileges is implicitly enabled by quite a bunch of other options, I disabled all of them for testing purposes in my /lib/systemd/system/mympd.service.

Test:

systemctl show mympd.service  | grep -i NoNew
NoNewPrivileges=no

Afterwards, it still does not work, but I get a different error message:
Dez 06 17:55:23 jdr-musibert mympd[4425]: sudo: unable to change to root gid: Operation not permitted
Dez 06 17:55:23 jdr-musibert mympd[4425]: sudo: error initializing audit plugin sudoers_audit

Probably I will just implement a quick and dirty workaround for now.

[jcorporation]

The NoNewPrivileges is implied also by user=.

The only workaround I know, is to override the complete mympd.service file and add the mympd user manually.

groupadd -r mympd
useradd -r -g mympd -s /bin/false -d /var/lib/mympd mympd

curl -s https://raw.githubusercontent.com/jcorporation/myMPD/v10.0.0/contrib/initscripts/mympd.service.in | sed 's|@CMAKE_INSTALL_FULL_BINDIR@|/usr/bin|'> /etc/systemd/system/mympd.service

[jdr85]

Hi Jürgen,

thanks. Is this now a non-standard service file which will not be part of the default myMPD installation? If this is the case, I would rather like to stick with the default provided with myMPD and use the following simple but probably not very professional workaround:

The lua script has the permissions to write to /var/lib/private/mympd/. Therefore I just let the lua script touch a file there and have a system background script check the existence of that file regularly. If it exists, the system is shut down.

Reboot.lua:

-- {"order":2,"arguments":[]}
-- /var/lib/mympd/scripts - mympd:mympd - 0700
os.execute("touch /var/lib/private/mympd/musibert-reboot")

Poweroff.lua:

-- {"order":2,"arguments":[]}
-- /var/lib/mympd/scripts - mympd:mympd - 0700
os.execute("touch /var/lib/private/mympd/musibert-poweroff")

mympd-shutdownhandler.bash:
(this is started from my custom startup scripts systemd service)

#!/bin/bash
# Regularly check whether shutdown or poweroff is requested by myMPD.

MYMPD_PATH="/var/lib/private/mympd"

while true
do
	# Check for poweroff
	if [ -f "$MYMPD_PATH/musibert-poweroff" ]
	then
		rm "$MYMPD_PATH/musibert-poweroff"
		echo "Initiating Poweroff"
		poweroff
	fi
	
	# Check for reboot
	if [ -f "$MYMPD_PATH/musibert-reboot" ]
	then
		rm "$MYMPD_PATH/musibert-reboot"
		echo "Initiating Reboot"
		reboot
	fi

	sleep 30
done

[jcorporation]

Systemd lets you override the distributed service file with your definition in /etc/systemd/system.

[Emilot]

If we want to shutdown or reboot our device (RPi for example) how we do it? @jdr85 solution is not an option, IMO.

If we can't execute such a simple script i would rather have the choice to sacrifice the security in my isolated(with firewall, etc) LAN and keep the easiness to execute simple tasks.

[jcorporation]

sudo does not work with the User= directive in a systemd service unit, because of the NO_NEW_PRIVILEGES flag. See my answer for the workaround.

[Emilot]

Ok JC i will try your answer and i will post my findings.

But let me ask this:

If there is a user with limited knowledge of Linux, etc...want to use myMPD and he/she also want to shutdown his device, what he/she can do about it?

Thank you

[jcorporation]

myMPD's scripting function is not designed to control any linux functions that need root privileges. The new systemd service unit is a huge security improvement and will be the default.

[Emilot]

Ok JC. Understood

[jcorporation]

Searched around, I found another solution: https://tojaj.com/how-to-turn-off-a-linux-system-without-root-or-sudo/

[jcorporation]

Adding CAP_SYS_BOOT could work also.

[Emilot]

Thank you for your suggestions

[pgzh]

Searched around, I found another solution: https://tojaj.com/how-to-turn-off-a-linux-system-without-root-or-sudo/

@jcorporation : Have you managed to get this working from a mympd script?
I'm trying to get my Pi to power down with this method, but the following script won't work:
-- {"order":1,"arguments":[]}
output = mympd.os_capture("dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1 'org.freedesktop.login1.Manager.PowerOff' boolean:true")
return output

If I run the command manually as regular user via ssh, the Pi powers down immediately:
$ dbus-send --system --print-reply --dest=org.freedesktop.login1 /org/freedesktop/login1 'org.freedesktop.login1.Manager.PowerOff' boolean:true
method return time=1676921879.818717 sender=:1.3 -> destination=:1.19 serial=144 reply_serial=2
$ Connection to 10.0.7.47 closed by remote host

This seems like the cleanest solution, but I am probably overlooking something here...

[jcorporation]

No, I do not tried that solution. Could it be a permission problem? You can try to run the command with systemd-run to debug it better.

[pgzh]

mympd[1053]: Failed to connect to bus: $DBUS_SESSION_BUS_ADDRESS and $XDG_RUNTIME_DIR not defined (consider using --machine=@.host --user to connect to bus of other user)

Seems the neccessary environment variables are not set when running with DynamicUser...
Looks like that won't work as easily as I thought.

[Emilot]

Your suggestions work just fine (new service file under /etc...with the addition of the .conf file)

Thank you JC