How to Open xterm window from a terminal and run a command in background from xterm?

Question

My application tries to execute roots command "sudo ifup eth0" and "sudo ifdown eth0". But it returned an error "sudo: sorry, you must have a tty to run sudo". So, it requires a tty to execute the sudo commands. So, I tried to execute the commands by opening tty sessions

gnome-terminal --command="sudo ifdown eth0" &
xterm -e "sudo ifdown eth0" &

then it worked fine. But I am not able to send the command from newly created gnome-terminal or xterm. i.e., if I close the newly created gnome or xterm windows before they had executed the commands, then the commands were terminated immediately.

Can you give suggestion how to disable the window from closing by the user or how to make it invisible to the user?

Note: you can test this by using system-config-network command instead of ifdown and ifup

Solution 1

I would suggest not to use xterm or gnome-terminal to provide a terminal for sudo, but to deal with the "sorry, you must have a tty to run sudo" message directly.

There is a requiretty option in the sudoers file that makes sudo demand a terminal. If this option is unset with !requiretty and the command is executed with the NOPASSWD option sudo should run without the need to open a new terminal window. There are more details in this serverfault post.

That is how sudo is used for instance in cron scripts.

Since requiretty option provides additional security in an environment where sudo is used not only in cron scripts but to let remote users issue commands with elevated privileges, the action of !requiretty can be restricted.

   User_Alias LOCAL_USERS = john, mary
   Cmnd_Alias NETWORK_SCRIPTS = /sbin/ifup, /sbin/ifdown
   Defaults!NETWORK_SCRIPTS     !requiretty
   LOCAL_USERS ALL = NOPASSWD: NETWORK_SCRIPTS

Solution 2

If you run your code within X session, then you can use gksudo instead of sudo:

gksudo -m "Your message" /command/to/run

It will prompt user for password (if needed) using nice GUI interface. No need to xterm or gnome-terminal.

Effect will be more secure than allowing particular command to run without any password and solution will be more consistent to what users are used to.

Solution 3

In general, sudo or su need to prompt for a password, or programs could escalate their privileges without user intervention. If you application needs to elevate for some purpose, you will need to use an xterm or similar. There are difficulties though in getting the return code back (konsole might need --nofork and gnome-terminal might need --disable-factory, but the options sadly vary by version), and it's not easy to get it right on every system. Most unixes and linux distributions provide xterm, but some old Fedora/RHEL/CentOS provide X without xterm, so it's another dependency to think about.

The command launched by xterm -e sudo -- ... can then do the standard double-fork and setsid. Once the user has entered his password in the xterm, it goes away immediately, but your command runs in the background with elevated privileges. It can connect back to the original program using a socket or fifo to run as a root co-process.

The daemon or disown commands or similar might be useful if you want to wrap an existing application in a double-fork & setsid (eg, xterm -e sudo -- daemon system-config-network or perhaps xterm -e sudo -- bash -c "system-config-network & disown -a").