I'm currently using sudo a lot in a bunch of scripts, which is turning into a bit of a hassle, as some scripts does not allow interactive input (e.g., Makefiles).

Instead of disabling sudo passwords altogether I'm thinking it would be nice if gnome-keyring or some similar keyring software could be used to rememeber the password. Is this a good idea? Is it possible? Any better solution?

  • why not edit your sudoers file to add the NOPASSWD attribute to the commands you find repetitive? user ALL=(ALL) NOPASSWD: <full path to command> – h3rrmiller Jan 9 '13 at 15:08
  • I could do that, but I was hoping for some kind keyring solution, as it would be somewhat more convenient. – Kotte Jan 9 '13 at 15:30
  • 1
    sudo is unaware of gnome-keyring. you can use sudo -i or sudo bash or sudo su to get an interactive shell and then run your scrips though. – h3rrmiller Jan 9 '13 at 15:32
  • problem is I was trying avoid starting new interactive shells. Ok, but then setting NOPASSWD might be the answer for me... – Kotte Jan 9 '13 at 15:58

There is a timeout option provided with sudo.


Defaults:username timestamp_timeout=time_in_minutes

If you want to keep root rights, just launch your script as root. I agree, this is not optimal but this is actually what you are already doing.

Instead, I would rather group all the stuff that can be done without root privilege together and the ones requesting root privilege together and launch them at two separate times... This is what is usually done :

sudo make install

BTW, if your are on a box with Xorg, you could use gksudo instead of sudo. But again, burying "sudo"s in script is not a good practice.

  • This doesn't answer the question. Kotte is looking for a way to store the password in a keyring software. – Gilles Jan 9 '13 at 22:03
  • Ok, then the answer is NO. But sudo and PAM are open source software so if someone wants to write a PAM module or to alter sudo in such a way, please do so. But I think this is a wrong answer to a true problem. He is not the only one to be in this case. He thought about gnome keyring, I just pointed out how the OTHERS are tackling this problem. Period. BTW, he gave some background in order for us to understand his REAL problem which I was trying to address. If I just asked how I could use the root account as my every day account, wouldn't you try to understand why and prevent me to do so ? – user21228 Jan 10 '13 at 8:26
  • My previous solution was actually to use gksudo, but after I changed distro to Fedora gksudo was no longer available. I agree, a better solution would be to group things together in order to be able to run sudo make install. But the build system I'm working on is pretty complex and there are a bunch of people already using it, so a rewrite is not really doable ATM. But being able to store password using some keyring seemed like a "good enough" solution to me. Knowing that sudo is unaware keyrings is a good enough answer for me ATM. – Kotte Jan 10 '13 at 11:04
  • I completely agree that a rewrite would be difficult. I don't know anything about your build system, but you can already try to gather some figures about it. For instance, how many "sudo"s are there in your scripts? A simple grep -nr sudo . should do the trick. If you have hundreds of them, you might want to find something else. If there are juste a dozen of them, you should be able to factor them within 1 hour... – user21228 Jan 10 '13 at 13:30
  • Hmm, I'll need to take a look at it. If I get some time over I'll consider the rewrite, but I feel my question have been answered :). Thanks for all the help! – Kotte Jan 11 '13 at 9:57

What you are asking for sounds doable, combining the -A option of sudo and the program gnome-keyring-query.

Basically, if you use the option -A, instead of reading the password from stdin, sudo reads the password from an external program that you can specify with the SUDO_ASKPASS environment variable.

This external program could be gnome-keyring-query, a command line tool for storing/getting passwords from gnome-keyring. Here is the help of gnome-keyring-query:

    gnome-keyring-query <mode> <name>
    mode     - either 'get' or 'set' (without quotes)
    name     - a name to identify the key
    If mode is 'get', then the password is dumped to stdout.
    If mode is 'set', then the password is read from stdin.

Here is how you can proceed (I just tried, it works).

  1. Install gnome-keyring-query (You will have to compile it if it is not packaged by your distro -> upstream url)
  2. Save your sudo password in the gnome-keyring
  3. You should be able to retrieve the password from the keyring with something like: gnome-keyring-query get sudo
  4. Save this command as a script (for example in /usr/bin/sudo_askpass) and make sure it is executable with chmod
  5. export SUDO_ASKPASS=/usr/bin/sudo_askpass
  6. Use sudo -A instead of sudo.

That being said, be aware that if you save your password in the keyring and leave this keyring open, anyone can read your sudo password very easily, either using this gnome-keyring-query tool, or just simply by launching seahorse. So be very careful.

  • That actually looks pretty neat. I'll try it out. Thanks :) – Kotte May 22 '13 at 14:51
  • If it actually works, I suggest you mark this as the best answer :) – user48678 Jun 8 '13 at 12:45
  • ▶ dnf provides gnome-keyring-query Last metadata expiration check: 6 days, 10:22:06 ago on Tue May 16 13:48:15 2017. Error: No Matches found – utopic eexpress May 22 '17 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.