Checking server user permissions to use sudo

[lunardunno]

Adding support for the wheel group to work with the sudo package.

Checking and redefining the system locale to C if the system locale differs from en_US.UTF-8|C.UTF-8|C, for correct operation of the script with the server controller.

Checking that the sudo package is pre-installed if the user is not the root.

Checking the presence of the user or the required group in the sudoers file.

Checking permission to run the package manager via sudo.

Checking for no password prompt.

Implementation of using the user's home directory name to define the CUR_USER variable when whoami is missing.

Correction of descriptions and translations of errors: ServerUserNotInSudo and ServerPacketManagerError.

Checking the availability of the server user's home directory. Lack of such access leads to the incorrect information that the package manager is busy and Error 206 (ServerPacketManagerError). Or leads to the incorrect information that the server port already allocated (Error 201)

[vanyasem]

Shouldn't this script have a shebang #!/usr/bin/env bash at the top?

[lunardunno]

For what purposes?
This script is executed in sh.
Have you tried running it in sh?

[vanyasem]

You're right, a shebang won't help, as the script is executed line-by-line. My mistake

However, it uses the default user's shell instead of directly calling sh:

1. The script is ran in ServerController::isUserInSudo:
   

   amnezia-client/client/core/controllers/serverController.cpp

   Line 771 in 1570647

   ErrorCode error = runScript(credentials, replaceVars(scriptData, genVarsForScript(credentials)), cbReadStdOut, cbReadStdErr);

2. ServerController::runScript sends the command to an ssh client:
   

   amnezia-client/client/core/controllers/serverController.cpp

   Line 87 in 1570647

   error = m_sshClient.executeCommand(lineToExec, cbReadStdOut, cbReadStdErr);

3. Finally, Client::executeCommand calls libssh:
   

   amnezia-client/client/core/sshclient.cpp

   Line 148 in 678bfff

   int result = ssh_channel_request_exec(m_channel, data.toUtf8());

4. ssh_channel_request_exec Run a shell command without an interactive shell.: https://api.libssh.org/master/group__libssh__channel.html#ga567d509183ade0a77190f390e2b5747d

You might get confused by the phrase This is similar to 'sh -c command'.

This implies the fact that a non-interactive shell is spawned, similar to how sh -c executes commands in a non-interactive shell. It does not mean that the commands are in fact executed in sh. Any shell has a non-interactive mode, and the default shell for the particular user is used to run the command.

There is no guarantee that the user's shell will be POSIX-compliant. For example, having fish or pwsh set as a login shell breaks the execution of the script. See #1201

This could be fixed by prefixing every line with /bin/sh -c or something similar.

At the very least, there could be a check that verifies that a supported (POSIX-compliant) shell is being used by the specified ssh user.

[vanyasem]

I actually made a small example to prove that your assumption that the code is ran in /bin/sh is wrong: https://gist.github.com/vanyasem/4c931f186c48da7b98b0f5518f1c6c64

ssh_example establishes an SSH connection via a private key, and then executes ssh_channel_request_exec(channel, "echo $0"). The output of the command is printed to console. echo $0 returns the name of the currently running program, which in this case would be the name of the shell.

As you can see, changing the user's shell by calling chsh results in $SHELL being changed. If the commands were executed in sh, the value would always be sh