velzie/chromeos-117-sudo-howto.md

## chromeos-117-sudo-howto.md

      
    Raw
  

              chromeos-117-sudo-howto.md
            
          
    Short guide on how to bypass this:

If you haven't disabled rootfs verification, switch to vt-2 and run /usr/libexec/debugd/helpers/dev_features_rootfs_verification. Then reboot.
Inside crostini, download minioverride.c and compile it with gcc minioverride.c -o minioverride.so -shared (make sure gcc is installed)
In the files app, move minioverride.so into your downloads folder.
Switch to vt2, and in the root terminal, not crostini, run these commands
mkdir -p /usr/local/bin
mv /home/chronos/user/Downloads/minioverride.so /usr/local/bin/
chmod +x /usr/local/bin/minioverride.so
sed -i '1s/^/env LD_PRELOAD=\/usr\/local\/bin\/minioverride.so\n/' /etc/init/ui.conf 
reboot
After rebooting you should be able to use sudo inside crosh as you would normally before updating to 117. It will display the warning, but sudo should work regardless.
NOTE:
When you update chrome os versions, this will stop working. You don't need to redo the whole thing, just run /usr/libexec/debugd/helpers/dev_features_rootfs_verification, reboot and run sed -i '1s/^/env LD_PRELOAD=\/usr\/local\/bin\/minioverride.so\n/' /etc/init/ui.conf and reboot again.
1/29 - added fix for landlock policy (fixes permission denied writing to disk)
restart the entire process with the updated c code if you want to fix it

  
## minioverride.c
int minijail_no_new_privs(){
    return 0;
}
int minijail_add_fs_restriction_rx(){
    return 0;
}
int minijail_add_fs_restriction_advanced_rw(){
    return 0;
}
int minijail_set_enable_profile_fs_restrictions(){
    return 0;
}
int minijail_enable_default_fs_restrictions(){
    return 0;
}
	int minijail_no_new_privs(){
	return 0;
	}
	int minijail_add_fs_restriction_rx(){
	return 0;
	}
	int minijail_add_fs_restriction_advanced_rw(){
	return 0;
	}
	int minijail_set_enable_profile_fs_restrictions(){
	return 0;
	}
	int minijail_enable_default_fs_restrictions(){
	return 0;
	}