Okay, first of all, I know this question has been asked a few times here, but the answers given did not entirely satisfy me.
The situation is the following: I have written many scripts to automate various maintenance tasks, with the aim to be fully automatic and requiring not interaction at all once started.
Now often root privileges are needed for various tasks (like mounting stuff etc.) but much more often I do not like commands or entire blocks to be executed with superuser rights (like wget, or extracting an archive fetched from the web etc.), to limit damage in the worst case.
So obviously to satisfy my aims the script has to be called using
su and drops privileges and regains them, depending on the commands.
Now I have considered a few options but they did not satisfy me entirely and therefore I would like to consult with experts here, to know which would be the best solution (with the aim that the code is easily understandable and logically structured for others as well once published):
1.) Factor out the bits to execute as non root user into an external file and execute that file from the main script using
su <user> -c /path/to/file.
That methoed however has a couple of disadvantages: First of all it ruins the logical structure of the script and makes things harder to understand and to read, as well as creating problems with defining and using variables.
2.) Define an alias or a function to shorten
su <user> -c "command". This is a really bad idea as 80% of the scripts would have that privilege prefix. Apart from that, multi-line commands are problematic (like if structures that contain commands that I do not want to run as root).
3.) Something like
su <user> << EOF << ... EOF which would properly handle entire blocks of code. This would be the most elegant solution (because the logical structure of the script is not destroyed) if there was not one problem that bugs me: Syntax highlighting. All major editors I tried use one color for the entire block inside the here doc. It is not exactly nice to read through a script where 80% have no syntax highlighting.
Is there no really elegant way to handle this issue? Something like
su <user> -c ( ...) without quotes would be cool. Or should I maybe switch to another shell? (right now I use bash, I heard zsh has a feature that allows setting EUID variables or something like that?)
If there is no elegant solution, which approach would be preferable?