I'm writing a shell script, that needs to be run with root privileges.

I can check if a user has root privileges with sudo -nv || echo "no sudo", but that doesn't help me, if his credentials are still cached by sudo, but he didn't call my script with it. So I have no way of reacting to a user, not calling my script with sudo.

I could put sudo in front of every command that needs it, so just checking to see if the user has root privileges would be enough, but it seems to me, that there should be a better solution.

I'm looking for a command, that I can put into my script, that asks the user for root privileges and, if provided, executes the rest of the script, as if the user called it with root privileges in the first place.

What I want:


if ! command; then        # what I'm looking for
    echo "This script needs root privileges."
    exit 1

mv /bin/cmd1 /bin/cmd2    # requires root

Edited 2 times

  • If the user is running the script, and you want them to sudo every command in the script, I don't understand why they wouldn't just sudo the script. Even if you sudo every command and redirect stdout/stdin/stderr properly, the user still has to enter root credentials either way. – cremefraiche Dec 11 '14 at 14:16
  • "I'm looking for a command, that I can put into my script, that asks the user for root privileges and, if provided, executes the rest of the script," This is exactly what running the script as sudo does. Seems like reinventing the wheel. – cremefraiche Dec 11 '14 at 14:17
  • @cremefraiche If the user runs the script with sudo, that would be completely fine. What I'm looking for is a failsafe if they don't do that. Checking for root privileges like I mentioned above does not ensure, that the user called my script with sudo, just that the credentials are cached. So I'm looking for something, that runs the script as if the user called it with sudo in the event, that he forgot. – Minix Dec 11 '14 at 14:26
  • I understand now, It seemed to me that you were checking if users were sudoers to prevent malicious use, which was hard for me to understand what the problem was. I have now updated my answer to achieve this effect without causing unnecessary lines of code to be run. – cremefraiche Dec 11 '14 at 15:07

Test if you are root, and if not, restart with sudo, for example:

#! /bin/bash

if [[ $EUID -ne 0 ]];
    exec sudo /bin/bash "$0" "$@"
  • I thought about something like that. But I was a bit hesitant. Are there any security concerns? Will read the man page about exec. Didn't need it until now. – Minix Dec 11 '14 at 14:54
  • @Minix it's a shell builtin. Try help exec, or look at the man page of bash or sh. I think this is safe, but I am not sure. – muru Dec 11 '14 at 14:55
  • 1
    probably want to pass the args too: exec sudo /bin/bash "$0" "$@" – glenn jackman Dec 11 '14 at 15:53
  • 2
    This is probably plenty safe on any system that interprets the #! bangline - provided the proper sudo is in $PATH. If the presumption is that the bangline is interpreted then the /bin/bash bit is not really necessary though - exec sudo "$0" "$@" should be enough - and might be beneficial in that on those POSIX systems that dont handle the bangline but still do sudo it would probably still get the original script run with escalated privileges. Where sudo is iffy, POSIX also specs the newgrp command. – mikeserv Dec 11 '14 at 18:15
  • 1
    well, the very first bullet in the shell command language spec reads: The shell reads its input from a file (see sh), from the -coption or from the system() and popen() functions defined in the System Interfaces volume of IEEE Std 1003.1-2001. If the first line of a file of shell commands starts with the characters "#!", the results are unspecified. I think that is a windows thing - POSIX is not all about unix-likes. I never tried to hunt it down, though. Thats also about what the shell itself does with it - not the kernel. POSIX doesnt tell kernels what to do, mostly. – mikeserv Dec 11 '14 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.