Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I run a specific program with root privileges (Ubuntu OS) when no sudo user is logged into the system? The program needs root privileges to function correctly. A normal user shouldn't be able to shutdown this process. For example, I have two users, Admin and Client; The program should start only when the client logs into the system. It needs root privileges and the Client shouldn't be able to shut this process down.

share|improve this question

There are a few ways to do this. Ubuntu's graphical login is provided by GDM (or KDM if you're using Kubuntu). GDM is started by the Upstart subsystem.

The startup process follows these steps:

  1. System boots. Upstart starts services, including GDM (/etc/init/gdm).
  2. GDM starts, initializes the X-server (/etc/gdm/Init/*), and presents the GUI login window.
  3. A user logs in.
    1. PAM authorization happens (/etc/pam.d/gdm)
    2. GDM runs PostLogin script (/etc/gdm/PostLogin/*).
    3. GDM runs PreSession script (/etc/gdm/PreSession/*).
    4. GDM runs Xsession and xinit scripts
      (/etc/gdm/Xsession, /etc/X11/xinit/xinitrc.d/*, /etc/X11/Xsession, /etc/X11/Xsession.d/*)
  4. The user's desktop appears.

Where to run your script

Everything prior to XSession runs as root. /etc/gdm/Xsession and everything after runs as the user. This leaves you with three real options for where to run your script.

  1. Modify GDM/KDM's PostLogin or PreSession scripts to run your program. The username is available in the USER or USERNAME environment variables.

  2. Use PAM to execute your script. PAM will set the authorizing user in the PAM_USER environment variable. Add this to /etc/pam.d/gdm to kick off your script:

    auth  required   /path/to/your/script
    • You might be able to use PAM to match a particular user (as in this answer), so the script would only run for that user and wouldn't need to match users itself. I don't have the PAM expertise to explain how to do that.

  3. Write an Upstart script to run your program. Your script would start at user login, so we look for the desktop-session-start signal emitted by GDM's PreSession script.

    So an Upstart script would detect that signal as the run trigger:

    # start when GDM's PreSession script runs
    start on desktop-session-start

    The signal from PreSession doesn't pass along the username, so you'd need to tweak the signal. In /etc/gdm/PreSession/Default, find the initctl line and change it to this. You could also use USERNAME in place of USER.

    # add USER variable so Upstart script can find it
    initctl -q emit desktop-session-start DISPLAY_MANAGER=gdm USER=$USER

    See the manpages for Upstart and its starting event for more details.

How to avoid the Admin user

Your script will need to examine the user/username in the environment variables it gets from one of these methods and use that to determine whether to abort or continue. Standard shell-scripting methods will work. Depending on which starting location you chose from the above list, the username may be available in the USER, USERNAME, or PAM_USER environment variables.

share|improve this answer

You could use setuid, to always run the program as root. From a security point of view, this is probably a very, very bad idea. If one of your users managed to exploit the setuid program it will give them root access to the whole server

share|improve this answer
that works if it's a program the user wants to run. i don't think that's what this questioner is looking for tho. – quack quixote Apr 25 '10 at 5:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.