qubes-doc/developer/system/vm-sudo.md

lang	layout	permalink	redirect_from	ref	title
en	doc	/doc/vm-sudo-implementation/	/en/doc/vm-sudo-implementation/ /doc/VMSudo-implementation/	341	Passwordless root access in qubes

The rationale behind passwordless root in qubes is set out here. Implementation is by the qubes-core-agent-passwordless-root package.

This page sets out the configuration changes made, with (not necessary complete) list of mechanisms depending on each of them:

1. sudo (/etc/sudoers.d/qubes):

   Defaults !requiretty
   %qubes ALL=(ALL) ROLE=unconfined_r TYPE=unconfined_t NOPASSWD: ALL
   
   (...)
   

   • Easy user -> root access (main option for the user).
   • qvm-usb (not really working, as of R2).

2. PolicyKit (/etc/polkit-1/rules.d/00-qubes-allow-all.rules):

   //allow any action, detailed reasoning in sudoers.d/qubes
   polkit.addRule(function(action,subject) { if (subject.isInGroup("qubes")) return polkit.Result.YES; });
   
   

   PAM (/etc/pam.d/su.qubes or /usr/share/pam-configs/su.qubes)

   auth    	sufficient	pam_succeed_if.so use_uid user ingroup qubes
   

   • NetworkManager configuration from normal user (nm-applet).
   • Updates installation (gpk-update-viewer).
   • User can use pkexec just like sudo Note: above is needed mostly because Qubes user GUI session isn't treated by PolicyKit/logind as "local" session because of the way in which X server and session is started. Perhaps we will address this issue in the future, but this is really low priority. Patches welcomed anyway.

3. Empty root password:

   • Used for access to 'root' account from text console (qvm-console-dispvm) - the only way to access the VM when GUI isn't working.
   • Can be used for easy 'su -' from user to root.