Program runs from root at startup but I cannot tell which program

mbevks

I get this message (see below) when I startup. I'd like to know which program is giving me that message. I'm a bit noobish. Is there a good way to figure out which program is triggering that?

WetGeek

mbevks Is there a good way to figure out which program is triggering that?

The message itself tells you that /bin/sh requires authentication. Does that help?

Also, if you do go ahead and give it your password, can you tell what happens next?

tomscharbach

@WetGeek @riffer @synth-ruiner Like you, I think that the authentication is required to run a bash script. My guess is that we all suspect that the script is related to a specific app/program that was user-installed after Solus was installed, and that the app/program is set up to run at on startup and requires the script to obtain the necessary permissions to run.

So far, so good. That brings us back to the original question:

mbevks Is there a good way to figure out which program is triggering that?

We've all asked, in different ways, what apps/programs where installed after Solus was installed, focusing on non-repos apps and apps installed immediately before the authentication notification. No response so far, but I assume that we will get an answer in time, and that answer will point in a direction.

I'm wondering if coming at the problem from another direction might be helpful. The script, if typical, is likely to be stored in /etc/init.d. Once displayed, the script, should identify the app/program that is attempting to run at start up. Is there a way to identify the script in /etc/init.d, or at least make a good guess as to which script it might be?

mbevks

WetGeek As far as I can tell, nothing happens. Why would /bin/sh require authentication? What kind of information can I provide to help figure this out and stop unnecessary password requests?

tomscharbach

mbevks Why would /bin/sh require authentication? What kind of information can I provide to help figure this out and stop unnecessary password requests?

As WetGeek noted, /bin/sh is pointing to something that requires authentication to run.

I've seen this only once, on a computer with Dropbox installed. Files in the Dropbox folder were not owned by the user account. Dropbox attempted to run a script to change ownership of the files to the user, and the script required sudo privileges, triggering exactly this notification/request. It was years ago, and someone else's computer, but that's what I remember.

That might or might not (or something similar) be what is happening in your case. I don't have the skills to find what is triggering the authentication request. WetGeek or others might be able to help.

An obvious question is whether you installed any applications (e.g. Dropbox or other applications) immediately before the authentication request started showing up. If you did, then that's where I would look.

mbevks

tomscharbach I've seen this only once, on a computer with Dropbox installed. Files in the Dropbox folder were not owned by the user account.

That's it. Thanks!

elfprince

I have this experience with NordVPN. It asks for the sudo password in exact same way.

riffer

I think sh points to bash.

OP - have you installed any programs after installing the OS other than those in the repository? Maybe a tarball or build from source?

tomscharbach

riffer I think sh points to bash.

As far as I know, that's right. My guess is that /bin/sh is pointing to a script.

riffer OP - have you installed any programs after installing the OS ...

That's the key question -- what got installed just before the authentication requirement started showing up.

synth-ruiner

I think /bin/sh is whichever shell you have set up, which is bash by default in Solus. as others have said, I think there's a shell script set to run on startup.

WetGeek

synth-ruiner

Exactly. Apparently sh will run whatever POSIX-compliant shell is installed. Whatever is invoking that script at startup probably has no idea which shell is installed, but knows that sh will run it.