3

From https://calibre-ebook.com/download_linux

sudo -v && wget -nv -O- https://download.calibre-ebook.com/linux-installer.sh | sudo sh /dev/stdin

What is the purpose of sudo -v && here, given that man sudo says

 -v, --validate

Update the user's cached credentials, authenticating the user if necessary. For the sudoers plugin, this extends the sudo timeout for another 15 minutes by default, but does not run a command. Not all security policies support cached credentials.

What is the purpose of sh /dev/stdin? (In Ubuntu 18.04, sh is dash)

Thanks.

1
  • 1
    Reading the code before executing it is good advice. I would rather wget -nv -O- script.sh | cat first to read the contents of the file! Mar 27, 2023 at 20:28

1 Answer 1

6

What is the purpose of sudo -v && here?

I believe this minimizes user surprise. Consider two scenarios:

  1. sudo is not configured to require a password for commands (the NOPASSWD tag)

versus:

  1. sudo is configured to require a password for commands

In the first scenario, both calls to sudo succeed without any prompts. Problem solved!

In the second scenario, there are again two possibilities: either the user has recently authenticated to sudo or they have not.

  • If they have recently authenticated, sudo -v simply updates the timestamp of their cached credentials.
  • If the user has not authenticated to sudo recently, it will prompt them for their password; once authenticated, their credentials are then cached.

Once the sudo -v process succeeds, the second sudo sh /dev/stdin call should use their cached credential and run uninterrupted.

Consider the alternative (where sudo is still configured to prompt for a password) where there is no initial sudo -v command. In this case, wget may have written output to stdout or stderr, which may cause the user to miss seeing it and wonder why nothing is happening.

What is the purpose of sh /dev/stdin?

Here sh is being called with a parameter as the command_file that is a special file -- a link to stdin.

NAME dash — command interpreter (shell)

SYNOPSIS

 dash ...
      [command_file [argument ...]]

As a result, sh reads the command_file, expecting and executing commands from it. That special stdin "file" is connected via the pipe to the output from wget, so the end result is that the contents of the URL are sent to a root-level shell.

I do not know why the Calibre project specifically chose that syntax. Alternatives include:

  • ... | sudo sh
  • ... | sudo sh -
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .