[1703] in athena10
Re: sudo's lecture_file for "You're in a chroot!"
daemon@ATHENA.MIT.EDU (William Cattey)
Mon Mar 16 00:44:50 2009
In-Reply-To: <alpine.DEB.2.00.0903121559430.8802@geminorum.mit.edu>
Mime-Version: 1.0 (Apple Message framework v753.1)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <7B30C261-C471-43E4-87CC-ED20D65953CA@mit.edu>
Cc: debathena@mit.edu
Content-Transfer-Encoding: 7bit
From: William Cattey <wdc@MIT.EDU>
Date: Mon, 16 Mar 2009 00:43:45 -0400
To: Geoffrey Thomas <geofft@mit.edu>
This looks like a sane thing to do. Would you open a debathena trac
on it?
-Bill
On Mar 12, 2009, at 4:14 PM, Geoffrey Thomas wrote:
> Hey,
>
> We noticed on zephyr today that sudo has a lecture_file option that
> will cause it to print a custom message the first time you run
> sudo. I propose we use it to do something like
>
> $ sudo aptitude install snes9x-x
> Attention: You are on a Debathena cluster machine. Although you
> can use
> sudo to become root, your access is restricted to a sandbox (chroot)
> created when you logged in. If you install software or change
> global settings, they will be reverted when you log out.
>
> If you would like a permanent change to cluster machines, please
> report a bug via the "sendbug" command.
>
> Enter your Athena password below.
> [sudo] password for geofft:
>
> This would involve setting "Defaults lecture_file=(this warning)
> lecture=once" in /etc/sudoers.
>
> Another option would be to do this with pam_echo in /etc/pam.d/sudo
> and /etc/pam.d/su. It has the advantage of also working for su, but
> making it warn you only once would be harder, so we'd probably have
> to say something shorter like "Warning: You are in a login sandbox.
> See http://... for more information."
>
> Another option would be for 'tellme root' to print the same warning
> to cover the 'su' case, although unless we change the root password
> nobody will notice...
>
> --
> Geoffrey Thomas
> geofft@mit.edu
