8

I have a bash script that needs to run with root privileges, but must be invoked by the normal user.

Difficult part is that the script should not ask for a password, and I don't want to use the sudoers file. I'd like to avoid using sudo or su.

Is this possible?

1
9

If it wasn't a bash script but a regular application, you would give ownership of it to root and set the setuid bit on the application. Then upon execution, the effective user the application is running under is root. Due to security concerns however this is in many systems prohibited for shell scripts. This question here on unix.stackexchange.com does handle ways how to overcome this.

6
  • Nice, I was just posting a link to that. Hemant's answer is a good solution Oct 8 '10 at 7:51
  • Would Ruby count as a shell script?
    – Stefan
    Oct 8 '10 at 7:52
  • 1
    @Stefan Yes, anything that gets run through an interpreter does, because it's not the script itself that gets run, it's the ruby interpreter, which isn't setuid. You need an actual binary to use setuid Oct 8 '10 at 7:53
  • 2
    I wish I could vote this down, but unfortunately I lack 25 reputation points. Letting normal users run a bash script as root is a VERY BAD idea, unless you know exactly what you're doing (and if you have to ask how to do it, you don't). If the OP posted his script here, I'd probably find at least 3 ways to exploit it. There is a reason almost all distributions make this hard.
    – Kim
    Oct 8 '10 at 8:54
  • One of the main principles of Unix is: "Give the user any opportunity to shoot himself in the foot" :-)
    – fschmitt
    Oct 8 '10 at 9:25
1

Use sudo. If you don't want to have to call sudo /path/to/myscript, write a one-line wrapper exec sudo /path/to/myscript "$@". See Allow setuid on shell scripts, particularly Maciej Piechotka's answer on using sudo and my more general discussion of setuid programs.

2
  • The whole idea is to not have to use sudo. Oct 16 '13 at 19:20
  • @AlexejMagura Sudo is the easiest solution. This is hard to do without sudo (unless you're willing to settle for an insecure solution, in which case you might as well give everybody the root password). Oct 16 '13 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.