0

I'm working on a machine where I don't have root, but there is a list of allowed sudo commands. One of these commands is /bin/su - foouser. So I can type sudo su - foouser, and I get an interactive shell as foouser. Then I can run some stuff as foouser.

The problem is that foouser is a shared user/shell that is used for spawning certain important production processes. I can't easily customize it or set it up the way I want. And I shouldn't be working in it consistently which splits up my terminals, and command history between ones where I'm logged in as myself and ones where I'm foouser.

What I'd really like to do is to have a way to run a single command as foouser, have it block, print out stdout and stderr to my shell as a command usually would, and then return with me still logged in as myself (and not foouser). This could e.g. be encapsulated in a script so that as_foo bar runs the command bar, as foouser, prints stdout and stderr, returns return code of bar, and then puts me back in my shell.

I can ask the sys admins to change permissions. For example, they could add bar to the sudo list, and then I could use (I think) su -c to run bar in the fashion I described. But then if the next day I want to run bar2, I have to talk to them again.

Is there any way out of this dilemna? It seems rather silly because I obviously can become foouser and run as many commands as I want, so there is no difference in terms of security that I can see. Just can't find any obvious convenient way to make this possible.

1

sudo su - foouser <command> requires you to have at least limited root access to run su - foouser <command> as root.

sudo -u foouser <command> can do what you want in one step. But it requires that the sysadmin has granted you sudo access to foouser account in this way:

ignacio ALL=(foouser) ALL

instead of this way:

ignacio ALL=(root) su - foouser

Configuring sudo in this way will allow you to define e.g. an alias like you envisioned:

as_foo='sudo -u foouser'

And by avoiding the su -, you may be able to keep using your own customizations: using sudo in this way changes just the user identity but keeps HOME at its previous value, reading any shell startup scripts and other customizations from your home directory instead of foouser's.

(Of course, those scripts must then be readable by that other user too, and any shared scripts you might run had better refer to foouser's home directory explicitly as /home/foouser instead of just $HOME.)

However, there are some sudo settings that can prevent that solution from working: if the always_set_home sudo option is set in the sudoers file, or if env_reset option is set without adding HOME to the env_keep list, HOME will be reset anyway. In such a situation, try adding the -E option to sudo command to explicitly request keeping your environment.

And when you really want to run something as foouser with the environment set exactly as it is when logged in as foouser (i.e. the equivalent of sudo su - foouser), add the -i option to specifically request that. So sudo -i -u foouser is an 100% accurate replacement of sudo su - foouser.

If you find some system with such an ancient version of sudo that it does not have the -i option, use the -H option with sudo instead: it's not a perfect replacement, but it might be enough. Such an old version of sudo will quite likely have some security-sensitive known bugs too, so it would be worthwhile to update it anyway.

You can use sudo -l as yourself to see exactly how your sudo access is defined and which sudo options (aka Defaults entries) are in effect for you.

  • This looks very promising, I'll accept as soon as I'm able to test and it works! – Nir Friedman Nov 23 '17 at 15:10
0

Pass additional arguments to su.

sudo su - foouser sh -c 'echo $USER'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.