1

I wrote a script and I'm using a construction like this inside of it FILES=($S_DIR/$OPTIONS), where i basically create an array of files. Like this: FILES=(/tmp/*/workspace/*zip).

This works fine for me, until the script runs against a 700 file/folder. Is there a way to call this particular line with sudo? I can of course use find or ls to get the file list. But I'd like to figure it out if this way is also possible too. Thanks!

EDIT:

I'm writing a check for Nagios and want check all files of specified type within of folder. All files I want to check have 700 rights on them, so the nagios user can't read them. And array FILES is not bound in the end. And i can't check the desired file propertys. So I'm searching for way to populate FILES=($S_DIR/$OPTIONS) without external utility like find or ls. My script works on files/folders there the user have rights. In short: I need to elevate the rights for only this line in the my script: FILES=(/tmp/*/workspace/*zip)

  • 1
    What problem do you expect sudo to solve for you? – fpmurphy Sep 10 '16 at 9:14
  • Shouldn't that glob work fine even if you can't read some of the files or directories, your shell should just ignore them. What are actually trying to do, can you edit the question to show a working sample of the problem? – ilkkachu Sep 10 '16 at 10:20
  • globing jumps files that can't be read, but i need all files to check. – 0xbadc0de Sep 10 '16 at 10:53
3

First, no, you can't push an assignment like the FILES=blah into another process, since the variables are internal to the shell, and while exported variables propagate downwards to children, there's no method to propagate them upwards to the parents and ancestors of a process.

You could, however, run an external command and pick its output to an array. Though it's not as safe regarding special characters in file names as the shell glob since bash doesn't seem to like '\0' as a separator. If you don't have files with newlines, then this should work:

IFS=$'\n'   # only split on newlines
FILES=( $(find ...) )  # or
FILES=( $(sudo find ...) )  

However, if you produced the file list with elevated privileges, you might not be able to access the files in the list afterwards anyway. For example if they were in a directory the user doesn't have access to, even a stat on them would not work.

And in any case, to do any of this safely, you'd need to have a very limited set of allowed commands in sudo (for the user running the script). Otherwise there's nothing to stop someone from changing the sudo find to sudo find -delete or worse.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.