openSUSE with sudo – but convenient!

If you are used to handling activities with administrator rights (“root”) like I am from the Debian world, you will have some difficulties with openSUSE in the beginning. With two users it is still possible, because you can set the same password for both user and root. But at the latest with more user accounts this is already over, unless you give the root password to everyone. Both solutions are certainly somehow practicable, but it’s not very nice. Especially since sudo would actually be installed – but only halfway through.

So I started with my current openSUSE Tumbleweed to teach the system a reasonable sudo concept and then apply it to YaST. It was a bit nasty to find out, but in the end it worked well.

Let’s go!

visudo

By default sudo asks for the root password. This is pretty nonsensical, so let’s change it!

In the first part we still work as normal users. The line details may vary depending on the age of the file/system version and previous changes to it.
```
sudo visudo
```
The parameters in line 43 starting with env_keep = “LANG… at the end within the quotation marks:
```
DISPLAY XAUTHORITY
```
Comment out lines 68 and 69 completely, so that the password of the “target user” is no longer requested:
```
#Defaults       targetpw
#ALL    ALL = (ALL) ALL
```
Additionally you uncomment line 81, so delete the comment character #:
```
%wheel ALL=(ALL) ALL
```
Save, close and then add your user(s) to the group “wheel” either via YaST or directly in the terminal:
```
gpasswd -a <dein-username> wheel
```
By logging out and in again, the change will be applied and sudo wants to have your user password in the terminal from now on.

YaST

For the graphical version of YaST, PolicyKit is used for authentication, a little more work is needed here. From here on, you work as root, so change the account with su –.

Create a PolicyKit Action for YaST

vim /usr/share/polkit-1/actions/org.opensuse.pkexec.yast2.policy

Insert the following XML block into the file. Please pay attention to line breaks when copying/pasting.

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/software/polkit/policyconfig-1.dtd">
<policyconfig>

  <action id="org.opensuse.pkexec.yast2">
    <message>Authentication is required to run YaST2</message>
    <icon_name>yast2</icon_name>
    <defaults>
      <allow_any>auth_self</allow_any>
      <allow_inactive>auth_self</allow_inactive>
      <allow_active>auth_self</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/usr/sbin/yast2</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
  </action>

</policyconfig>

Save, close – the success can be checked as a regular user with pkexec /usr/sbin/yast2.

Save the default rights configuration and replace it with the system configuration. Our file will not be overwritten during an upgrade.
```
mv /etc/polkit-default-privs.local /etc/polkit-default-privs.local.bkup
cp /etc/polkit-default-privs.standard /etc/polkit-default-privs.local
```
The necessary adjustment is to replace auth_admin with auth_self everywhere. You can also do this by hand, but with sed it is more convenient and faster:
```
sed -i 's/auth_admin/auth_self/g' /etc/polkit-default-privs.local
```
To make the authentication via PolicyKit work, create a short shell script that will be called from the menu in the future:
```
vim /usr/local/sbin/yast2_polkit
```

The script looks like this, just add it to the yast2_polkit file:

#!/bin/bash

if [ $(which pkexec) ]; then
        pkexec --disable-internal-agent "/usr/sbin/yast2" "$@"
else
        /usr/sbin/yast2 "$@"
fi

Save and close. Finally you make the script executable:
```
chmod +x /usr/local/sbin/yast2_polkit
```
Finally, you create a .desktop file. This will make the modified YaST starter appear directly in the main menu, system-wide for all users. For example, in Xfce it is listed under “Settings”. I have not tested other desktops, but I assume that the starter will end up in a useful place, since it is only a customized copy of the original.
Of course you could also edit the original file for YaST (YaST.desktop) but it will be overwritten during an upgrade. And a copy in /usr/local/share/applications ignores both the application and whisker menus.
So:
```
vim /usr/share/applications/YaST2.desktop
```

Insert and save:

[Desktop Entry]
X-SuSE-translate=true
Type=Application
Categories=Settings;System;X-SuSE-Core-System;X-SuSE-ControlCenter-System;X-GNOME-SystemSettings;
Name=YaST2
Icon=yast
GenericName=Administrator Settings
Exec=/usr/local/sbin/yast2_polkit
Encoding=UTF-8
Comment=Manage system-wide settings
Comment[DE]=Systemweite administrative Einstellungen
NoDisplay=false

That’s all. With this, a login as root is no longer necessary or can be done comfortably via sudo su – with your user password. Whether the concept of openSUSE is now worse or better, I don’t want to decide. That is a matter of taste, I think.
What I liked in any case is the clear adherence to standards. This makes finding solutions much easier and faster. Thanks to good documentation and helpful forum posts I was able to finish everything within about an hour – and the great knowledge of PolicyKit!