Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a bash script that needs to run with root privileges, but must be invoked by the normal user.

Difficult part is that the script should not ask for a password, and I don't want to use the sudoers file. I'd like to avoid using sudo or su.

Is this possible?

share|improve this question
    
possible duplicate of Allow setuid on shell scripts –  Stefan Oct 8 '10 at 7:53

2 Answers 2

up vote 6 down vote accepted

If it wasn't a bash script but a regular application, you would give ownership of it to root and set the setuid bit on the application. Then upon execution, the effective user the application is running under is root. Due to security concerns however this is in many systems prohibited for shell scripts. This question here on unix.stackexchange.com does handle ways how to overcome this.

share|improve this answer
    
Nice, I was just posting a link to that. Hemant's answer is a good solution –  Michael Mrozek Oct 8 '10 at 7:51
    
Would Ruby count as a shell script? –  Stefan Oct 8 '10 at 7:52
1  
@Stefan Yes, anything that gets run through an interpreter does, because it's not the script itself that gets run, it's the ruby interpreter, which isn't setuid. You need an actual binary to use setuid –  Michael Mrozek Oct 8 '10 at 7:53
1  
I wish I could vote this down, but unfortunately I lack 25 reputation points. Letting normal users run a bash script as root is a VERY BAD idea, unless you know exactly what you're doing (and if you have to ask how to do it, you don't). If the OP posted his script here, I'd probably find at least 3 ways to exploit it. There is a reason almost all distributions make this hard. –  Kim Oct 8 '10 at 8:54
    
One of the main principles of Unix is: "Give the user any opportunity to shoot himself in the foot" :-) –  fschmitt Oct 8 '10 at 9:25

Use sudo. If you don't want to have to call sudo /path/to/myscript, write a one-line wrapper exec sudo /path/to/myscript "$@". See Allow setuid on shell scripts, particularly Maciej Piechotka's answer on using sudo and my more general discussion of setuid programs.

share|improve this answer
    
The whole idea is to not have to use sudo. –  Alexej Magura Oct 16 '13 at 19:20
    
@AlexejMagura Sudo is the easiest solution. This is hard to do without sudo (unless you're willing to settle for an insecure solution, in which case you might as well give everybody the root password). –  Gilles Oct 16 '13 at 19:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.