mjhjmtu

I'm running CentOS7 on an old dell box that I repurposed as a home server. I also ssh into it from a remote location to make sure everything is running smoothly, and to do things like rsync my laptop. In other terms, nobody is usually at home to reset the machine if anything goes wrong.

The situation:

Sometime last week, I must have broken something that allows commands like sudo, su, and pkexec to work.

Su won’t accept my root password, sudo gives the error:

sudo: /usr/bin/sudo must be owned by uid 0 and have the setuid bit set

I tried running something like pkexec /bin/bash, but I got the error:

pkexec must be setuid root

seeing that, I then did:

[crlsmdrn@server ~]$ ls -l /usr/bin/sudo 

---x--x--x. 1 root root 143248 Jun 27 13:03 /usr/bin/sudo

So, is there any way to set permissions back to 4755 on sudo so I can get a root shell back remotely without having to reboot the machine?

Thanks

I was able to reset permissions on sudo without rebooting into rescue mode! This is what I did:

Thankfully, systemd was still allowing me to restart daemons because it was authenticating via polkit.

So, I made a unit file in my home directory containing:

/home/crlsmdrn/sudo-reset.service:

[Unit]
Description=reset sudo

[Service]
Type=oneshot
ExecStart=/home/crlsmdrn/sudo-reset.sh

[Install]
WantedBy=multi-user.target

I then made a file named sudo-reset.sh.

/home/crlsmdrn/sudo-reset.sh:

#!/bin/sh
chmod 4755 /usr/bin/sudo

Then:

[crlsmdrn@server ~]$ chmod +x /home/crlsmdrn/sudo-reset.sh

Followed by enabling and running the service:

[crlsmdrn@server ~]$ systemctl enable /home/crlsmdrn/sudo-reset.service
[crlsmdrn@server ~]$ systemctl start sudo-reset-service

[crlsmdrn@server ~]$ sudo
usage: sudo -h | -K | -k | -V
usage: sudo -v [-AknS] [-g group] [-h host] [-p prompt] [-u user]
usage: sudo -l [-AknS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command]
usage: sudo [-AbEHknPS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-u user] [VAR=value] [-i|-s]
 [<command>]
usage: sudo -e [-AknS] [-r role] [-t type] [-C num] [-g group] [-h host] [-p prompt] [-u user] file ...

I then was able to do sudo -s, then see what permissions were broken by looking back at the bash history; it looks like only /usr/bin got borked, so I ran rpm --setperms -a, which appeared to fix the permissions.

Don't forget to disable the service after doing this.

Moral of the story here: never run chown -R root:root on /usr/bin without expecting things to work the same.