2

I have a bash script that uses yum to install some Docker-related utilities, and naturally yum need sudo access. So I run the script via:

sudo ./myscript.sh

But the script ends up changing my user to root after it's done. This is an issue for me, because I want the end of the script to add the user running it to the Docker usergroup via:

groupadd docker
gpasswd -a $USER docker

So by the time the script finishes, it adds root to the group instead of the current user - I imagine this is because I run it with sudo.

Is it possible to sudo run a script but retain the current user's login? From what I understand it's generally not a good idea to use sudo within scripts.

Here's the script (edited after answers below):

#!/bin/bash

yum remove docker \
                  docker-common \
                  container-selinux \
                  docker-selinux \
                  docker-engine

yum install -y yum-utils device-mapper-persistent-data lvm2
yum-config-manager \
    --add-repo \
    https://download.docker.com/linux/centos/docker-ce.repo


yum makecache fast
yum install docker-ce

systemctl start docker

groupadd docker
groupadd docker
gpasswd -a "${SUDO_USER}" docker
su "${SUDO_USER}" -c "newgrp docker"
  • $USER is environment variable it displays the current user, so you're right, this is because sudo. To test , try sudo echo $USER and echo $USER and see the difference. – fugitive Jun 1 '17 at 20:59
  • @fugitive sudo echo $USER expands USER before calling sudo. You would need sudo bash -c 'echo ${USER}' – ctrl-alt-delor Jun 1 '17 at 21:13
2

You can check the SUDO_USER variable to determine whether the script is being run via sudo, and if so, which user ran it. Then you’d just use that in gpasswd:

gpasswd -a "${SUDO_USER}" docker

or

gpasswd -a "${SUDO_USER-$USER}" docker

if you want to fall back to USER in the absence of SUDO_USER.

The command which causes you to end up logged in as root (strictly speaking, this doesn’t change your login, it runs a new shell) is

newgrp docker

To fix that, i.e. end up as yourself with docker as your primary group, you need to run that as yourself; assuming sudo,

su "${SUDO_USER}" -c "newgrp docker"

will do this.

Note that ending your script with newgrp in this way means that your script doesn’t end as such when you get a new prompt; the result is

  • the shell you’re in when you type sudo ./myscript.sh
    • sudo
      • the shell running myscript.sh
        • newgrp
          • the shell started with docker as the primary group

The script will only exit when you exit the shell started by newgrp.

  • OK, that newgrp is a significant element which wasn’t mentioned initially ;-). See my updated answer. – Stephen Kitt Jun 1 '17 at 22:36
  • Ah yeah, sorry about that. I put it in there because I was aiming to use docker without sudo, and it mentioned that newgrp can be used rather than logging out. I'm mainly looking for a way to not have to exit the shell window I'm using once my user is added to the docker group. – Patremagne Jun 1 '17 at 22:43
  • Hmm, I'm getting the following output after adding the new 'newgrp' command (though it appears I am still able to execute Docker commands: bash: cannot set terminal process group (-1): Inappropriate ioctl for device bash: no job control in this shell – Patremagne Jun 2 '17 at 12:58
2

If using sudo at all is generally considered a good practice, and if using it -- especially within a short script meant to be executed manually -- simplifies logic or maintenance and achieves the desired goal, then I would say use of sudo within a script is appropriate, if not preferable.

It is possible to use sudo inside the script, and run the script as a normal user. The invoked sudo will normally ask for a password, just once (or not at all if the user has recently used sudo). However, for proper behavior the script should prevent a user from running it as root.

# This should not be run as root (or using 'sudo')
if [ "$(/usr/bin/id -u)" == "0" ] ; then
   echo "This script cannot be run as root (or using 'sudo')!" 1>&2
   exit 1
fi
# Use sudo per command here
sudo groupadd docker
sudo gpasswd -a $USER docker

Here, since the $USER variable corresponds to the normal user, it would be inserted as the expected argument for gpasswd.

This example would be run as a normal user; not sudo. Note however, the user must have sudo privileges for it to execute properly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.