text: I have to write a script on ubuntu and some commands require root privileges. The script is full of normal linux commands. Is it possible to write a switch user(su) script that automates the password prompt without needing user intervention?. Need help...
  I forgot to tell you that I'm asked to disable sudo access to all users and I did that. Alternate option?
  Thank you!
  you should use sudo. In the file /etc/sudoers you can configure the commands which should be run with root privileges and whether a password is needed or not.
  sudo
  /etc/sudoers
  Try 'bash -p', if -p not given then bash will keep the original uid/gid even if suid.
  As you said, you are unable to use sudo, you may think the other way around. Are you able to run the script as root and su to an user with lesser permission for the parts which do not need to be run as root?
  As already said, sudo is exactly what you need and the best solution (you know, that you can limit sudo access for each command separate?)
  Have a look at sudo. With this you can run specific commands with root privileges with or without the requirement to give a password.
  It should already be installed on your Ubuntu system
  EDIT
  Sudo has been designed to do exactly what you want in a secure, controlled and auditable manner. The safest thing to do is to allow users to run the script via sudo. This doesn't then allow users access to the individual commands.
  Discussion with the policy maker's should ensue.
  Edit 2
  You have to grant a user permission to run a particular shell via sudo before they can successfully run sudo -s. Just giving a user permission to run your script does not grant permission to run sudo -s.
  The approach you describe would require that anyone who could run the script would be able to read the script - and hence the root password.
  I'm asked to disable sudo access to all users
  I'm asked to disable sudo access to all users
  ! you've been asked to disable the sub-system which has been specifically designed by some very smart people to provide limited root access to designated users and now you need to provide root access to designated users with your own home grown solution (and have proposed a very bad way of solving the problem).
  You could set the sticky bit on the file permissions - but it'd take a very long time to go into the implications of doing that - and it seems that neither you nor the person who asked you to disable sudo really understand the Unix permissions model.
  Why not just lose the pretence and give the users the root password?
  visudo
  Do your own wrapper:
  /* mywrapper.c */
  #include <unistd.h>
  extern char **environ;
  main() {
  environ=NULL; /* clear environment variables for sanity */
  setuid(0);
  return execl("/usr/local/bin/script.sh", "script.sh", NULL);
  }
  Then gcc -o mywrapper mywrapper.c ; chown root mywrapper; chmod u+s mywrapper and you're ready to go.
  gcc -o mywrapper mywrapper.c ; chown root mywrapper; chmod u+s mywrapper
  By posting your answer, you agree to the privacy policy and terms of service.
  asked
  4 years ago
  viewed
  696 times
  active