sudo and newgrp problem

[wpdavids]

I hope others have run into this.
When using sudo combined with the "newgrp" command I am droped into the "root" user ID. This is what I am running:
sudo newgrp - d_tst
Environment 'tst' set.
root@mybox:/#

I am now "root" what is going on.
root@mybox:/# id
uid=0(root) gid=204(d_tst)groups=0(system),2(bin),3(sys),7(security),8(cron),10(audit),11(lp)

I really do not want this to happen and I have set the "sudoers" file up correctly I think.
Is there a security bug with sudo and the "newgrp" command?

thanx

 

[trifo]

Hi!

It is by the mechanism of newgrp command. As it is written in its man page, it replaces your shell with a new one, regardless if it runs successfully, or not.
Thus the effect with sudo is similar to starting a new subshell. Try running a [tt]ps -ef | grep ksh[/tt] before running [tt]sudo newgrp[/tt], and also right afterward. Then check process ID-s and process parents.

--Trifo

 

[wpdavids]

Trifo,
I checked the process IDs and noticed that the pid for "wpdavids" is the same as the process ppid for the "root" shell. Your right that the newgrp command replaces the current shell for a new one. However, why is it replacing the shell from a regular user to the "root" ID?

I need to run newgrp with the sudo command and I do not want the shell to drop to the "root" ID.

How would the process ID check help me?

wpdavids 209642 196330 0 10:23:39 pts/1 0:00 -ksh
root 212642 209642 1 10:23:43 pts/1 0:00 -ksh

 

[trifo]

Well, you are dropped to root user, because sudo sets root user ID by default. Thus "sudo newgrp ..." starts a new shell environment (beacuse of sudo) and then newgrp replaces the newly created shell and keeps running. Now, if you type "exit", you will drop back to your original shell.
So this way is not for walk on.

By the way, what is the exact task to be done? Maybe I will be able to give some worthy support.

(I told you to chech PID-s to make you see the behaviour of the commands)

--Trifo

 

[bi]

If you are trying to change your group from your primary group to another group of which you are a member, you don't need root rights and so you don't need to use sudo.

But having seen the results of sudo newgrp, you'll probably want to configure sudo so no one can execute sudo newgrp.

 

[trifo]

bi: Well, you told the right words. People authorized to use newgrp will be able to do so without root privileges.

--Trifo