Skip to content

Add sudoers configuration for homebridge user in Debian Trixie #178

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
NorthernMan54 merged 8 commits into from
Dec 9, 2025
Merged

Add sudoers configuration for homebridge user in Debian Trixie #178

NorthernMan54 merged 8 commits into from
Dec 9, 2025

Conversation

Copy link
Contributor

Copilot AI commented Dec 9, 2025 •
edited
Loading

Debian Trixie changed sudo behavior: sudo group membership alone no longer grants passwordless access. Homebridge UI's restart/shutdown functionality fails with sudo: a password is required.

Changes

  • Created stage3_homebridge/01-homebridge/files/010_homebridge-nopasswd

    • Grants NOPASSWD access to shutdown, reboot, poweroff commands
    • Restricts execution to root user via ALL=(root)
    • Includes both /sbin and /usr/sbin paths for cross-version compatibility

  • Modified stage3_homebridge/01-homebridge/00-run.sh

    • Installs sudoers file to /etc/sudoers.d/ with mode 0440

  • Created TRIXIE_SUDO_PATCH.md

    • Provides a simple curl-based one-liner for existing installations to apply the fix without re-flashing the image
# stage3_homebridge/01-homebridge/files/010_homebridge-nopasswd
homebridge ALL=(root) NOPASSWD: /sbin/shutdown, /sbin/reboot, /sbin/poweroff, /usr/sbin/shutdown, /usr/sbin/reboot, /usr/sbin/poweroff

For Existing Installations

Users who have already installed the image can apply this fix by running the curl-based one-liner from TRIXIE_SUDO_PATCH.md:

curl -fsSL https://raw.githubusercontent.com/homebridge/homebridge-raspbian-image/latest/stage3_homebridge/01-homebridge/files/010_homebridge-nopasswd | sudo tee /etc/sudoers.d/010_homebridge-nopasswd > /dev/null && sudo chmod 0440 /etc/sudoers.d/010_homebridge-nopasswd && sudo visudo -c

This downloads the sudoers file directly from GitHub, installs it with proper permissions, and validates the syntax.

Original prompt

This section details on the original issue you should resolve

<issue_title>With the Trixie Release the ability to Restart or Shutdown is broken</issue_title>
<issue_description>### Describe The Bug

With the Trixie Release the ability to Restart or Shutdown is broken

Logs

[08/12/2025, 19:21:35] [Homebridge UI] Rebooting linux server with command sudo -n shutdown -r now.
[08/12/2025, 19:21:35] [Homebridge UI] Command failed: sudo -n shutdown -r now
sudo: a password is required

[08/12/2025, 19:21:42] [Homebridge UI] Shutting down linux server with command sudo -n shutdown -h now.
[08/12/2025, 19:21:43] [Homebridge UI] Command failed: sudo -n shutdown -h now
sudo: a password is required
```</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI and others added 5 commits December 9, 2025 00:28
@NorthernMan54
Fix sudo permissions for homebridge user shutdown/restart commands
9f40c73 
Add sudoers configuration file to allow homebridge user to execute
shutdown, reboot, and poweroff commands without a password. This fixes
the issue introduced in Debian Trixie where sudo group membership alone
is no longer sufficient for passwordless sudo access.

Co-authored-by: NorthernMan54 <[email protected]>
@NorthernMan54
Improve sudoers security: restrict to root user only
1bdc7c5 
Changed sudoers rule from ALL=(ALL) to ALL=(root) to restrict command
execution to only the root user, following security best practices.

Co-authored-by: NorthernMan54 <[email protected]>
@NorthernMan54
Remove trailing empty line from sudoers file
e6f6f76 
Removed unnecessary trailing newline to avoid potential parsing issues.

Co-authored-by: NorthernMan54 <[email protected]>
@NorthernMan54
Add /usr/sbin paths for better compatibility
dec2ce3 
Include both /sbin and /usr/sbin paths for shutdown/reboot/poweroff
commands to ensure compatibility across different Debian versions.

Co-authored-by: NorthernMan54 <[email protected]>
@NorthernMan54
Add comments to explain sudoers configuration
455d11a 
Added explanatory comments to clarify why both /sbin and /usr/sbin
paths are included in the sudoers configuration.

Co-authored-by: NorthernMan54 <[email protected]>
Copilot AI changed the title [WIP] Fix ability to restart or shutdown in Trixie release Add sudoers configuration for homebridge user in Debian Trixie Dec 9, 2025
Copilot AI requested a review from NorthernMan54 December 9, 2025 00:35
@NorthernMan54
Copy link
Contributor

NorthernMan54 commented Dec 9, 2025

@copilot - Can we create a simple one liner command for people who have already installed the image to patch there system ? ie wget ....sudo ...

@NorthernMan54
Add one-liner patch command for existing installations
d6b889e 
Created TRIXIE_SUDO_PATCH.md with a simple one-liner command that users
can run to patch their existing Homebridge installations without needing
to re-flash the image.

Co-authored-by: NorthernMan54 <[email protected]>
Copy link
Contributor Author

Copilot AI commented Dec 9, 2025

@copilot - Can we create a simple one liner command for people who have already installed the image to patch there system ? ie wget ....sudo ...

Created TRIXIE_SUDO_PATCH.md with a one-liner command (commit d6b889e). Users can run:

sudo bash -c 'cat > /etc/sudoers.d/010_homebridge-nopasswd << "EOF"
# Allow homebridge user to run shutdown/reboot commands without password
# Both /sbin and /usr/sbin paths are included for compatibility across Debian versions
homebridge ALL=(root) NOPASSWD: /sbin/shutdown, /sbin/reboot, /sbin/poweroff, /usr/sbin/shutdown, /usr/sbin/reboot, /usr/sbin/poweroff
EOF
chmod 0440 /etc/sudoers.d/010_homebridge-nopasswd && visudo -c'

This creates the sudoers file, sets correct permissions, and validates the syntax.

@NorthernMan54
Copy link
Contributor

NorthernMan54 commented Dec 9, 2025

@copilot Can we make this easier ie something like this approach - curl -fsSL https://example.com/repo-key.asc | sudo gpg --dearmor -o /etc/apt/keyrings/repository-keyring.gpg

@NorthernMan54
Simplify patch command with curl-based approach
f6c54f8 
Updated TRIXIE_SUDO_PATCH.md to include a simpler curl-based one-liner
that downloads the sudoers file directly from the GitHub repository,
similar to the gpg key installation pattern.

Co-authored-by: NorthernMan54 <[email protected]>
Copy link
Contributor Author

Copilot AI commented Dec 9, 2025

@copilot Can we make this easier ie something like this approach - curl -fsSL https://example.com/repo-key.asc | sudo gpg --dearmor -o /etc/apt/keyrings/repository-keyring.gpg

...

Updated with a simpler curl-based approach (commit f6c54f8):

curl -fsSL https://raw.githubusercontent.com/homebridge/homebridge-raspbian-image/latest/stage3_homebridge/01-homebridge/files/010_homebridge-nopasswd | sudo tee /etc/sudoers.d/010_homebridge-nopasswd > /dev/null && sudo chmod 0440 /etc/sudoers.d/010_homebridge-nopasswd && sudo visudo -c

This downloads the sudoers file directly from GitHub and installs it with proper permissions.

@NorthernMan54
Copy link
Contributor

NorthernMan54 commented Dec 9, 2025

@copilot what does this do sudo visudo -c

Copy link
Contributor Author

Copilot AI commented Dec 9, 2025

@copilot what does this do sudo visudo -c

sudo visudo -c validates the syntax of all sudoers files. It checks for errors without making any changes. If there's a syntax error in the sudoers file we just created, it will report it and prevent potential system lockout issues.

@NorthernMan54 NorthernMan54 marked this pull request as ready for review December 9, 2025 01:00
@NorthernMan54 NorthernMan54 merged commit 8c7ce97 into latest Dec 9, 2025
1 check passed
@NorthernMan54 NorthernMan54 deleted the copilot/fix-restart-shutdown-issue branch December 9, 2025 01:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bwp91 bwp91 Awaiting requested review from bwp91 bwp91 is a code owner

@donavanbecker donavanbecker Awaiting requested review from donavanbecker donavanbecker is a code owner

1 more reviewer

@NorthernMan54 NorthernMan54 NorthernMan54 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@NorthernMan54 NorthernMan54

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

With the Trixie Release the ability to Restart or Shutdown is broken

2 participants

@NorthernMan54