Incorrect permissions for the “sudo” command in 6.12.20

[cedric_starke]

Hello community,

I have tried to change the user rights management of the Linux system I am using.
Instead of using root, I would like to add two new users. One as a “normal” user and one as a “sudo” user.

To solve this, I added the following lines to my local.conf:

inherit extrausers
EXTRA_USERS_PARAMS = "\
    useradd -M -N -G sudo -p 'test01' sudo_user; \
    useradd -M -N -G users -p 'test02' normal_user; \
    "

This seems to work, as the users are listed in /etc/passwd and /etc/shadow.

To execute root commands, I also need the sudo command. To include this in my package, I added the following to local.conf:

IMAGE_INSTALL:append = " sudo"

This installs the sudo command in my package, but the permissions are incorrect and result in the following output:

sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set

To solve this problem, I can change the permissions in the running system as follows:

chown root:root /usr/bin/sudo
chmod 4755 /usr/bin/sudo

But I need this directly as bitbake output.

Does anyone have any idea what I might have overlooked?

I am using Linux 6.12.20 for an iMX8M Mini based on the DDR4 EVK and the Bitbake image "fsl-image-machine-test".

The image “imx-image-multimedia” already includes sudo, but the permissions appear to be the same.

[Oswalag]

Hello,

Please check the link below: 

https://unix.stackexchange.com/questions/375433/etc-sudoers-vs-etc-sudoers-d-file-for-enabling-sudo-...

[cedric_starke]

Hi @Oswalag,

Thanks for your reply, but the link has nothing to do with my problem.

I didn't mention in my question that I had already decided to change the sudoers file and comment out the line:

# %sudo ALL=(ALL) ALL

So my sudo user could run sudo IF the sudo command itself had the correct permissions.

However, after the YOCTO build, the sudo command shows me the following permissions:

---x--x--x 1 root root 334976 Mar  9  2018 /usr/bin/sudo

To run it as a member of the sudo group, the following is required:

-rwsr-xr-x 1 root root 334976 Mar  9  2018 /bin/sudo

Do you have any thoughts on this point

[Oswalag]

I understand, please try to add to your local.conf

EXTRA_IMAGE_FEATURES += "allow-setuid"

[cedric_starke · Accepted solution]

Hi @Oswalag,

Thanks for your reply, but when I run “bitbake”, with this option, I get an error.

In the end, I solved the problem by using a “bbappend” in my own layer, as shown in this example:
https://github.com/stromerbike/meta-medusa-dist/blob/master/recipes-extended/sudo/sudo_%25.bbappend

Maybe this will help someone else.