I just created a script that is being run as a
@reboot item in
It runs two scripts...in order. One creates ramdisks and populates them, and another runs an executable that depends on those ramdisks.
The first script looks like this:
#! /bin/bash cd ~/trlserver/nginx mkdir -p logs sudo mount -t tmpfs -o size=1024M tmpfs logs sudo chown $(whoami): logs cd ~/trlserver/data mkdir -p 20180927_na2018_ramdisk sudo mount -t tmpfs -o size=5G tmpfs 20180927_na2018_ramdisk sudo chown $(whoami): 20180927_na2018_ramdisk cp -a 20180927_na2018/* 20180927_na2018_ramdisk cp -a 20180927_na2018.additions/* 20180927_na2018_ramdisk
I've read the accepted answer here: https://askubuntu.com/questions/173924/how-to-run-a-cron-job-using-the-sudo-command
1) I could move this to be run separately (
sudo crontab -e), and hardcode the user name, but how do I guarantee it would be executed before the script that depends on it?
2) What prevents an attacker from creating a cron job (
crontab -e) that uses sudo set to run one minute from the current time...effectively bypassing password entry for use of
sudo? (I tried this and it seemed to work)