Completely locked out of sudo on secure-boot ubuntu

[x10an14]

Describe the bug

This has to do with the issues referencing sudo enabled by default.

My difference from the original issue (closed 20hrs ago as of this writing), is that I am on a secure-boot tpm-encrypted work laptop.
I am not allowed to put a password on my root account.
I am not allowed to have multiple users (at all).
I am not allowed to turn off secure-boot.
I am not allowed to get password to UEFI/BIOS (which is locked for the aforementioned reasons).

There's a reference in the release documentation to "Safety-wise, this feature never deletes an existing user. If anything goes wrong, disabling system-manager resets the users and groups to what they were before the system-manager activation".

Is this possible to do without sudo? If not, then what is it this line is supposed to say?

To Reproduce

Steps to reproduce the behavior:

1. Set-up full tpm-backed secure-boot with LTS ubuntu encrypting drives
2. Use system-manager post 1.0 (not expecting breaking changes)
3. Get hit by the abovementioned issues (or something similar).

Expected behavior

Breaking changes to not be introduced.

System information

flake.lock system-manager section:

"system-manager": {
      "inputs": {
        "flake-compat": "flake-compat_4",
        "nixpkgs": [
          "nixpkgs"
        ],
        "userborn": "userborn"
      },
      "locked": {
        "lastModified": 1773827232,
        "narHash": "sha256-7oAUEjTDc7tgNYbaxrPTqJsq1CCh1hObkW8orBcvZNM=",
        "owner": "numtide",
        "repo": "system-manager",
        "rev": "617183f535579e431803403063182c040e2685d2",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "system-manager",
        "type": "github"
      }
    }

❯ : uname; lsb_release -a
──────────────────┬──────────────────────
 kernel-name      │ Linux
 nodename         │ nav-x10an14-t14
 kernel-release   │ 6.8.0-60-generic
 kernel-version   │ #63-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 19:04:15 UTC 2025
 machine          │ x86_64
 operating-system │ GNU/Linux
──────────────────┴──────────────────────
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 24.04.4 LTS
Release:	24.04
Codename:	noble

Additional context

[jfroche]

Hello, I get your frustration, I am sorry you faced that bug on main.

We could have communicated more that main is not guaranteed to be bug free. This is all done on a best-effort basis.

We are doing our best to fix bugs as soon as they are reported, but we can’t guarantee that there won’t be any bugs on main.

We already added new tests (see #431) to make sure that new features won’t silentely touch existing files. I’m also working on improving the documentation.

To feel a bit more safe with more battle tested code, I’d recommend tracking releases in your flake input using “github:numtide/system-manager/v1.1.0”.

In the meantime, is the pkexec bash polkit trick good enough to unlock you?

[x10an14]

Hi and thanks for your follow-up @jfroche!

First of all, I was hoping you'd answer this from my opening post:

There's a reference in the release documentation to "Safety-wise, this feature never deletes an existing user. If anything goes wrong, disabling system-manager resets the users and groups to what they were before the system-manager activation".

Is this possible to do without sudo? If not, then what is it this line is supposed to say?

---

(...) This is all done on a best-effort basis.
We are doing our best to fix bugs as soon as they are reported, but we can’t guarantee that there won’t be any bugs on main.

Second of all, I want to apologize if it came across as if I was expecting perfection from a volunteer project.
That was not my intention!
I understand and accept that there could be bugs on main^^

---

We could have communicated more that main is not guaranteed to be bug free. (...)
To feel a bit more safe with more battle tested code, I’d recommend tracking releases in your flake input using “github:numtide/system-manager/v1.1.0”.

Following the tags is a good suggestion I'd consider, thanks, I did not know (nor see/find?) any documented release plan detailing what's the intention (I just assumed semver after the 1.0.0 release this past new years/christmas holiday).
Is this present somewhere?

---

In the meantime, is the pkexec bash polkit trick good enough to unlock you?

In any event, no, I am not able to recover my sudo permissions w/pkexec, at least not yet (I use nushell, not bash - need to try w/bash, get an illegal SHELL error message on nushell).

---

PS: I did see #431, that's one of the issues I linked in the first line with several links ;)

[Limosine]

I recently encountered the same issue on a Debian system. The sudoers file had been changed to only grant access to the newly created wheel group. I was able to recover using systemd-run -t su and editing the sudoers file configuration.