sudo does not work with gpg-script

Lotharster · 07-10-2006, 04:11 PM

I made the following script, which basically tars the /etc directory and encrypts it via gpg.

Code:

tar cfzp - /etc | gpg -er root@wunderkiste >filename

When I start is as root, it works fine. When I start it as a normal user using sudo, it gives the error:

Code:

gpg: fatal: Directory `~/.gnupg' cannot be created: No such file or directory
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768

The line in visudo is:

Code:

username      hostname=(root) NOPASSWD: /usr/bin/scriptname

Can anybody tell me why the script does not work with sudo?

Thanks,
Lotharster

unSpawn · 07-11-2006, 08:21 PM

gpg: fatal: Directory `~/.gnupg' cannot be created: No such file or directory
Maybe gpg expects /root to be the current working directory so you should cd there before tarring/encrypting?
Does adding "--debug-all" to gpg tell more?

Lotharster · 07-12-2006, 03:34 PM

Quote:

Originally Posted by unSpawn

Maybe gpg expects /root to be the current working directory so you should cd there before tarring/encrypting?

This did not change anything.

Quote:

Does adding "--debug-all" to gpg tell more?

A bit more:

Code:

gpg: Info: Default optionfile '~/.gnupg/options' does not exist
followed by the usual:
gpg: fatal: Directory `~/.gnupg' cannot be created: No such file or directory
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768

I set the optionfile to ~/.gnupg/gpg.conf, which does exist. Now I get:

Code:

Info: options are read from '/root/.gnupg/gpg.conf'
followed by the usual:
gpg: fatal: Directory `~/.gnupg' cannot be created: No such file or directory
secmem usage: 0/0 bytes in 0/0 blocks of pool 0/32768

It must have something to do with sudo, becausethe script works fine when I start it directly as root.
Anyway, thanks for your suggestions,

Lotharster

PS: I'm using a german locale, so I had to translate the error messages to english. The original english error messages might be slightly different.

unSpawn · 07-15-2006, 04:52 AM

Could you post the complete script in VBB code tags? TIA

Lotharster · 07-16-2006, 09:24 AM

Here's the complete script:

Code:

HOME=/root
cd
tar cfzp - /etc \
 |gpg -er root@wunderkiste \
 >"/backupetc/`date +%F_%H-%M-%S`_etc.tar.gz.gpg"

unSpawn · 07-16-2006, 09:46 AM

Tested your script with a dir with less contents, GnuPG 1.2.1, Sudo 1.6.7 and an unprivileged user with UID > 500 w/o probs. The "gpg: fatal: Directory `~/.gnupg' cannot be created: No such file or directory" looks like some permission problem. I have no other suggestions than to wrap gpg in strace, prefix gpg with something like "strace -v -o/tmp/strace.log".

Lotharster · 07-16-2006, 10:27 AM

Thanks for your suggestion. I have no experiance with strace, so I have no idea how to interpret its output. The whole logfile is quite large, so I'm posting just the (probably) relevant part here:

Code:

mmap2(NULL, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7c0d000
getuid32()                              = 0
mlock(0xb7c0d000, 32768)                = 0
getuid32()                              = 0
geteuid32()                             = 0
access("~/.gnupg/gpg.conf-1.4.2.2", R_OK) = -1 ENOENT (No such file or directory)
access("~/.gnupg/gpg.conf-1.4.2", R_OK) = -1 ENOENT (No such file or directory)
access("~/.gnupg/gpg.conf-1.4", R_OK)   = -1 ENOENT (No such file or directory)
access("~/.gnupg/gpg.conf-1", R_OK)     = -1 ENOENT (No such file or directory)
access("~/.gnupg/gpg.conf", R_OK)       = -1 ENOENT (No such file or directory)
stat64("~/.gnupg", 0xbf91caac)          = -1 ENOENT (No such file or directory)
stat64("~/.gnupg/options", 0xbf91caac)  = -1 ENOENT (No such file or directory)
open("~/.gnupg/options", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
access("~/.gnupg/random_seed", F_OK)    = -1 ENOENT (No such file or directory)
open("~/.gnupg/secring.gpg", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory)
access("~/.gnupg/secring.gpg", F_OK)    = -1 ENOENT (No such file or directory)
access("~/.gnupg", F_OK)                = -1 ENOENT (No such file or directory)
mkdir("~/.gnupg", 0700)                 = -1 ENOENT (No such file or directory)
open("/usr/share/locale/de_DE/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/de/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/de_DE/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/de/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en_GB/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/de_DE/LC_MESSAGES/gnupg.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/de/LC_MESSAGES/gnupg.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/de_DE/LC_MESSAGES/gnupg.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/de/LC_MESSAGES/gnupg.mo", O_RDONLY) = 3
fstat64(3, {st_dev=makedev(254, 0), st_ino=382966, st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096, st_blocks=280, st_size=137529, st_atime=2006/07/16-17:14:45, st_mtime=2006/05/29-21:27:59, st_ctime=2006/06/11-15:48:31}) = 0
mmap2(NULL, 137529, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7beb000
close(3)                                = 0
write(2, "gpg: fatal: ", 12)            = 12
write(2, "Verzeichnis `~/.gnupg\' kann nich"..., 76) = 76
write(2, "secmem usage: 0/0 bytes in 0/0 b"..., 54) = 54
exit_group(2)                           = ?

Sudo version 1.6.8p12
Btw, I'm using gpg (GnuPG) 1.4.2.2 and Sudo version 1.6.8p12, both the standard kubuntu dapper 6.06 LTS packages.

Thanks for your help,

Lotharster

unSpawn · 07-16-2006, 11:32 AM

Hmm. Try linking or copying ~/.gnupg/gpg.conf to ~/.gnupg/options

Lotharster · 07-16-2006, 12:01 PM

Quote:

Originally Posted by unSpawn

Hmm. Try linking or copying ~/.gnupg/gpg.conf to ~/.gnupg/options

That doesn't change anything. I think the problem is that for some reason, gpg cannot access the ~/.gnupg/gpg.conf file (although it exists). Here's the corresponding excerpt from the strace logfile:

Code:

access("~/.gnupg/gpg.conf", R_OK)       = -1 ENOENT (No such file or directory)

Matir · 07-16-2006, 12:18 PM

More notable is:

Code:

access("~/.gnupg", F_OK)                = -1 ENOENT (No such file or directory)
mkdir("~/.gnupg", 0700)                 = -1 ENOENT (No such file or directory)

This indicates to me that the home directory is not properly set. Try adding "echo ~" to your script and see if it shows the proper home directory.

unSpawn · 07-16-2006, 12:35 PM

That doesn't change anything. I think the problem is that for some reason, gpg cannot access the ~/.gnupg/gpg.conf file (although it exists).
Yeah, I was thinking of something else instead of closely reading strace output.
Anyway, same goes for the whole of ~/.gnupg:

Code:

stat64("~/.gnupg", 0xbf91caac)          = -1 ENOENT (No such file or directory)
mkdir("~/.gnupg", 0700)                 = -1 ENOENT (No such file or directory)
which it also sez in the output a bit further on:
write(2, "gpg: fatal: ", 12)            = 12
write(2, "Verzeichnis `~/.gnupg\' kann nich"..., 76) = 76

I can't see what's wrong with it if the permission show /root/.gnupg is owned by root and you "gpg --gen-key"'ed as root successfully. Can root sign or encrypt data from the CLI?

Matir · 07-16-2006, 01:02 PM

I think the big problem is that sudo retains the home directory of the user running sudo, not of root. So it's looking for ~user/.gnupg.

Lotharster · 07-16-2006, 03:03 PM

Got it at last!

The problem was the home directory. I set the home directory to /root at the beginning of the script, but I did not "export" it. So for some reason, gpg did not get it. Adding export to the first line fixed the problem.

Thanks for your help!

Lotharster