0

I have a script that I would like everyone (world) to be able to execute. However, one line in the script requires root privilege to run properly.

How can I make this script work for everyone, without requiring anyone to enter root credentials? If I preface the command with sudo then I assume every users will be prompted for root credentials.

#!/bin/bach
echo "works fine"
sudo rootonlycommand
echo "works fine"
Improve this question

1 Answer 1

Reset to default
2

sudo allows for entries in /etc/sudoers to have a NOPASSWD: option. And it also allows for ALL to be the source user.

So an entry such as

ALL ALL=(root) NOPASSWD: /bin/id

Would allow anyone to run the id command without a password.

$ sudo -k -K
$ sudo /bin/id
uid=0(root) gid=0(root) groups=0(root)
$
Improve this answer
6
  • 1
    +1. Also worth noting: OP has to be extremely careful about which commands they allow to be run as root. In particular, any programs that are capable of running other programs as they will also be run as root, for example editors such as vi, or text viewers such as less (which can run $EDITOR directly and any other program indirectly via $LESSOPEN). BTW, some programs have options that disable "dangerous features" like this (e.g. less has a -L / --no-less-open option to cause it to ignore $LESSOPEN), and these can be used within /etc/sudoers.
    – cas
    Aug 10 at 0:53
  • In most cases, it's better not to allow sudo access to particular programs, instead allow access to a wrapper script that runs those programs with specific, pre-defined options and/or arguments. e.g. if you need to allow a user to delete a particular file that they wouldn't normally have permission to delete, don't give them access to sudo rm, give them sudo access to a shell script that runs rm /full/path/to/just/this/one/file
    – cas
    Aug 10 at 0:58
  • Yes, I didn't go into the security concerns around what to grant sudo privileges to. I was focusing on the question asked. If the OP is concerned about that then I have a blog entry which explains how commands can be locked down (eg specific paramters) and the risks of wildcards and more ;-) sweharris.org/post/2018-08-26-minimal-sudo
    – Stephen Harris
    Aug 10 at 1:04
  • yep, I just thought it was important to mention because not enough people know that they should be extremely cautious about the secondary or indirect consequences of allowing root access to a program. It's very easy to accidentally give permission to run any program (and "any program" includes interactive shells, and scripting languages as well as obvious dangers like rm).
    – cas
    Aug 10 at 1:10
  • Good point. I'm only running pw-play which should be safe. (see unix.stackexchange.com/questions/753669/…).
    – TSG
    Aug 10 at 1:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .