I'm trying to find how is possible to execute a root command when a user starts their session.

I found that adding commands to this file /etc/rc.local should execute the commands after the boot, but my command is not being executed, or maybe the system is not ready yet to execute it. (the command works well)

Maybe an example could clarify what I'm trying to do. In almost all desktop managers there is an option at settings window called "Session and Start-up", and under the section "Application Auto-Start" it is possible to add commands that will be executed once the current user logs-in.

I'd like to do that but with a command that requires root permission.

  • 3
    Stuff that's in /etc/rc.local will be run once at system boot, before any one logs in. If it's not happening, the most likely reason is that it's being executed without any $PATH defined. Because of this, it's normal to use absolute paths in init scripts and rc.local. E.g. instead of: foobar -x -y -z use /usr/bin/foobar -x -y -z -- but again, to be clear, this doesn't run for every login. Just once at boot. If you are unsure of the correct path, check with which foobar or whereis foobar.
    – goldilocks
    Aug 10, 2014 at 11:22
  • @goldilocks I guess i can create an script that scans when users log in and then execute the command. I took a look to my rc.local script and i found that i wasn't using absolute paths. Also i found that the script exits when it gets and error so i redirected the errors 2>> /path.. and by surprise i found errors! Kinda weird because long time ago this rc.local edit was working!
    – user78927
    Aug 10, 2014 at 12:35
  • 1
    Unprivileged users can run "setuid" programs and scripts from their personal startup plumbing (such as .profile or the desktop's startup items, etc). But almost everyone will shout "don't do it!" out of security concerns. Another approach is to cook some longer-running script that runs as root on startup (i.e. in rc.local is one way) and let it check for new user logins to trigger the privileged logic.
    – Stabledog
    Aug 10, 2014 at 13:00
  • You can configure sudo to allow specified commands to be run as specified user, by specified users, without password. Aug 10, 2014 at 22:05
  • What problem are you actually trying to solve? This is probably not a good way to solve it. Aug 10, 2014 at 22:31

2 Answers 2


I found a solution creating a script that scans for users.

this is my /etc/rc.local script:

#!/bin/sh -e
# rc.local
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
# In order to enable or disable this script just change the execution
# bits.
# By default this script does nothing.

exit 0

and this is the detect_login script:

# -*- coding: utf-8 -*-

import os, time

while True:
    users=os.popen('''who | cut -d' ' -f1 | sort | uniq''')
    if Current_List:
        if Current_List != Buffer_list:

            if len(Current_List) > len(Buffer_list):

                #HERE YOU ADD THE COMMANDS, inside the triple quotes.
                # add each command in a new line

                # i let you an example for turning the brightness down..
                os.system('''/usr/bin/xdotool key XF86MonBrightnessDown''') 



I advice to run once the script as root to check that it works fine, because if there is one error rc.local will stop. (Dumb errors can be for example indented spaces, it happens often when copying python scripts from stackexchange forums)


You might be interested in pam_exec. I use it to open extra ports to addresses that have successfully authenticated to sshd. My /etc/pam.d/sshd has

account    optional     pam_exec.so /usr/local/bin/update-whitelist

and the update-whitelist script looks like


set -e

# Called from PAM when logging in via SSH.
# Adds current client to SSH whitelist.


test -n "$PAM_RHOST"
test -f "$WHITELIST"

# Handle PAM_RHOST as hostname or IPv4 dotted-quad
if echo "$PAM_RHOST" | /bin/grep -P -q '^\d+\.\d+\.\d+\.\d+$'
then echo "+$PAM_RHOST" >"$WHITELIST"
else /usr/bin/host "$PAM_RHOST" | /bin/sed -n -e 's/.* has address /+/p' >"$WHITELIST"

(I have iptables rules that use xt_recent with WHITELIST).

Also of interest may be libpam-script, which can run an arbitrary command as part of authentication or session start:

$ aptitude show  libpam-script 
Package: libpam-script
Version: 1.1.4-1
Priority: extra
Section: universe/admin
Description: PAM module which allows executing a script
 This module will allow you to execute scripts during authorization, password
 changes and sessions. This is very handy if your current security application
 has no PAM support but is accessible with perl or other scripts.
Homepage: http://sourceforge.net/projects/pam-script

I haven't actually used this, but it may be worth investigation.

You must log in to answer this question.