22

I've hacked together this bash script which tests if the user has superuser privileges and if they don't it asks for them. Ultimately I'm trying to invert the second 'if' statement so that I can remove the following two lines (the echo "password ok" and the else on the following line)

# Root user only
if [[ "$EUID" != 0 ]]; then
    sudo -k # make sure to ask for password on next sudo
    if sudo true; then
        echo "Password ok"
    else
        echo "Aborting script"
        exit 1
    fi
fi

echo "do my ops"

Is the purpose of "true" on the fourth line just a null-statement?

I need to invert the test on the fourth line, how do I do so? Here is what I've tried:

if sudo false; then  
if sudo true == false; then
if [!(sudo true)]; then
10
  • 1
    see stackoverflow.com/q/10552711/537980 Commented Mar 26, 2019 at 14:55
  • you can just remove the echo "Password ok", if you wish. Commented Mar 26, 2019 at 14:56
  • 1
    @ctrl-alt-delor following that link it seems all I need do is put an exclamation mark in front of the sudo and then I can remove both the echo and the else, and now i've tested it, that works, thanks. Commented Mar 26, 2019 at 15:15
  • 2
    In passing, you probably ought to redirect the error message to the error stream: echo "Aborting script" >&2 Commented Mar 26, 2019 at 17:24
  • 1
    This check is for convenience (fail early if the invoking user won't be able to use sudo), not security (prevent users from running the script), right?
    – Dennis
    Commented Mar 27, 2019 at 13:12

3 Answers 3

41

true in bash isn't a keyword, it's a program that instantly exits with a successful exit code. Likewise, false is a program that exits with an unsuccessful exit code.

You can try this out by running both programs from your terminal, and then reading the $? variable, which contains the exit code of the last program;

true
echo $? # 0
false
echo $? #1

if sudo true isn't equivalent to if sudo == true. if sudo true is running the true program using sudo, and checking the exit code.

Therefore:

if sudo false; then is running the program false as sudo. The return will always be false.

if sudo true == false will run the program true with the arguments == and false using sudo. This obviously isn't want you intended.

if [!(sudo true)] is invalid syntax.

What you are probably looking for is

if ! sudo true;
9
  • 12
    As a slightly pedantic correction to the first sentence: in bash, true and false are "builtins", commands interpreted directly by the shell; in Unix-like systems in general, they also exist as standalone programs on the file system. The difference doesn't matter that much here, but as far as I know, sudo true will be running the standalone program, not the bash builtin.
    – IMSoP
    Commented Mar 26, 2019 at 19:11
  • 33
    PS: my favourite summaries of true and false are the titles on their man pages: true - do nothing, successfully and false - do nothing, unsuccessfully
    – IMSoP
    Commented Mar 26, 2019 at 19:14
  • 3
    @IMSoP That's deep.
    – brainplot
    Commented Mar 27, 2019 at 12:54
  • 2
    If true didn't exist, the code in the question shows why one might need to invent it! It's a minimal program that can only fail if the system it's on is truly borked. So one can use it to establish if one's access credentials are OK.
    – nigel222
    Commented Mar 27, 2019 at 17:22
  • 2
    In AT&T SYSV Unix, "true" was a shell script /bin/true, which consisted of a large copyright notice in comments...and nothing else. Commented Mar 27, 2019 at 20:15
23

I feel like the accepted answer didn't actually answer your question?

The purpose of doing this is to check that you can actually sudo.

How this check is performed is via the true program as explained in the accepted answer.

6
  • 1
    Essentially, this. Alternative could be to check if the user is in sudoers group, but just running sudo true is also easy enough of a way, although a bit hacky. Commented Mar 27, 2019 at 3:32
  • 3
    Note that this also requires sudo to be installed, so the checks wouldn't be entirely equivalent... you could be in the sudoers group and still not be able to sudo. (This can especially come up if you're e.g. writing a script to setup a new image from a minimal rootfs tarball, which might not have sudo.)
    – user541686
    Commented Mar 27, 2019 at 3:38
  • 1
    The OP wants to drop out if you cannot sudo, and get rid of two lines rather than have an else following a noop.
    – mckenzm
    Commented Mar 27, 2019 at 4:10
  • 2
    And, conversely, you can also be able to sudo without being in the sudoers group if you (either personally or as a member of some other group) are listed in /etc/sudoers. But even sudo true is not infallible, as sudo access can be granted for only specific commands, so you may be able to sudo true, but not to sudo something_else, or vice-versa. There's no iron-clad way to test other than by trying to run the command you actually want to run with sudo. Commented Mar 27, 2019 at 14:42
  • 2
    Also, you can be in the sudoers group and not be able to sudo because the sudoers group is not listed in the sudoers file. A group with the four letters sudo in its name is not a valid indication of whether or not a user in that group can do any particular thing or anything at all using sudo.
    – jrw32982
    Commented Mar 27, 2019 at 19:13
5

As I see in this script. It is just checking if sudo is enabled, that is it..

true just returns true.

So in this case if they need to run any command with sudo it checks at start first, asking the password only one time.

The condition works like this: if sudo are executing the true command correctly, it will return true for the if condition, then sudo is enabled and the user typed the password correctly, else you typed the password wrong or sudo is not enabled, the script must not continue.

The other commands do not need to ask sudo password, because your authentication are sucessfully in first time (but this depends on the sudo configuration, so this scripts depends much in the environment configuration)

The 'echo password ok' demonstrate that too. the shell script will not ask the password anymore.

2
  • 1
    The only commands that run through sudo there are sudo true and sudo -k. The latter explicitly doesn't require a password. None of the other commands in the script run via sudo, so of course they will not require passwords, regardless of if the authentication was successful the first time.
    – ilkkachu
    Commented Mar 26, 2019 at 15:10
  • I wrote: "So in this case if they need to run any command with sudo it checks at start first, asking the password only one time. " Commented Mar 26, 2019 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .