Help setup passwordless sudo for stanley

[lm-ydubler]

Hi all, I need help setting up passwordless sudo for Stanley (Ubuntu 20.04)

First, I have a Rule successfully routing to an Action (a local shell script) that contains:

du -hs /tmp
find /tmp -atime +10 -delete

So this code successfully deletes standard files that don't require sudo, but, it doesn't delete the permission-unlocked test files in the /tmp/ folder. So I just need instructions on how to get StackStorm/stanley to run sudo commands knowing the following:

The user stanley (whose password I don't know) runs the commands.

I setup the action's YAML file with the sudo and sudo_password fields (using my admin's password):

The pack installs successfully and the Rules/Actions have been verified to be firing.

To setup passwordless sudo for stanley I added the following line to the end of /etc/sudoers:
stanley ALL=(ALL:ALL) NOPASSWD:ALL

But it's still not deleting the completely unlocked files in the /tmp/ directory so was hoping for some guidance or pointers on how to make it work.

Thanks and best

[minsis]

Can't you run core.local action? From there you could just create a rule with CronTimer once a day, or whatever frequency you want.

[minsis]

Here's an example off the cuff (I haven't tested it):

---
name: clear_temp_files
pack: examples
description: Delete temp files older than 10 days
enabled: true
trigger:
    type: core.st2.CronTimer
    hour: 05
    minute: 0
    second: 0
action:
    ref: core.local
    parameters:
        cmd: find /tmp -atime +10 -delete

[lm-ydubler]

Hi, thanks for your help. Yes, I can run core.local actions. But, after a little testing, I don't think core.local actions bypass the problem.

The problem is that calling the find /tmp command from inside StackStorm
st2 run core.local cmd="find /tmp"
doesn't return the same results as when find /tmp is run naturally from the terminal
find /tmp

(1)
So if we run st2 run core.local cmd="find /tmp" we get these results

... even when I completely unlocked all permissions for all users for the /tmp directory ...

(2)
And if we run find /tmp in the terminal we get these results:

So when we compare the results from (1) and (2) that shows that st2 run core.local cmd="find /tmp" and find /tmp do not produce the same results (despite unlocking all permissions) which is the root of the problem.

Note that running st2 run core.local cmd="find /home/root1/Desktop/" returns the same results as "find /home/root1/Desktop":

So StackStorm is doing something that is causing the find command to "not work correctly" with the /tmp directory. That is the problem. Do you know why?

[cognifloyd]

You are running into PrivateTmp: https://www.mankier.com/5/systemd.exec#Sandboxing-PrivateTmp

[lm-ydubler]

You are running into PrivateTmp: https://www.mankier.com/5/systemd.exec#Sandboxing-PrivateTmp

Wow, thank you @cognifloyd . Very good to know, much appreciated! If we revisit this workflow, that will be the key to actually unlocking this capability.