Sudo - is there a command to check if I have sudo and/or how much time is left?

Question

(Originally posted on Stack Overflow). They suggested I try here instead. Here's the original post:

• Sudo - is there a command to check if I have sudo and/or how much time is left?

See title. I want a command that lets me query sudo. Ideally, it would return success if I still have sudo and false if sudo has expired. Getting the time left might also be useful (although if I was concerned I could just do sudo -v to revalidate.) Oh and it shouldn't have to ask for a password.

The closest thing I've found is sudo -n true, but the -n option is only present on my Centos 5 machine at work. -n fails if it has to ask for a password. Is there any other way to get this functionality? Assume I don't actually have root on all the machines I work with, so I can't install new versions of sudo to my liking.

For what it's worth I'm doing this so I can get my prompt to indicate sudo status. I like knowing which terminals are actively sudo-able. I also have a prompt that changes colors when I'm root, but I don't use root very often so that's of limited use.

Answer 1

The -n option is available in newer versions of sudo, but as you stated that's not an option. There's no real way to do what you're looking for short of just trying sudo and seeing if it comes back with a prompt for a password. If your concern is you want a visual indication, why not start do sudo /bin/bash to start a root bash session? Note that this is insecure, but it's also somewhat insecure if someone realizes your prompt changes on sudo.

Answer 2

I know this is a really old question but here is I did in a script today. Assuming that being sudo means being able to run any command as sudo (or, at least, uptime)

CAN_I_RUN_SUDO=$(sudo -n uptime 2>&1 | grep "load" | wc -l)
if [ ${CAN_I_RUN_SUDO} -gt 0 ]
then
    echo "I can run the sudo command"
else
    echo "I can't run the Sudo command"
fi

However, if your user has restrictions in the visudo, this check will not be enough, e.g., if your user can only use the make command. Try running some command that you know will work.

You may add the filter grep -v Sorry, e.g.:

$(sudo -n uptime 2>&1 | grep "load" | grep -v Sorry | wc -l)

for avoiding those false positives.

Answer 3

To simplify the answer given by @wags007

if sudo -n true
then
  sudo id
else
  echo "sorry, but did not want to bother you"
fi

However, if in your https://www.sudo.ws/man/1.8.15/sudoers.man.html configuration you have defaults mail_badpass there will be a mail sent for every test that results in false (would have prompted). To avoid such nuisance change that part of your sudoers file to

Defaults       mail_badpass
Defaults!      /bin/true !mail_badpass

As a result security alert mails are send for all commands except /bin/true. Well yes, somebody could now try to brute force a password by calling sudo true an unlimited number of times without any security alert mail being sent.

Note: Always use visudo instead of your favorite editor to edit the sudoers file. Failing to do so you risk being locked out.

Answer 4

The command below will show a colored indication that you have sudo granted, so you remember to do a sudo -k before going away from the machine. It is useful also on non colored terminals.

As we can have sudo active and inactive on different terminal sessions, I created this that you can put at the end of your ~/.bashrc

function FUNCpromptCommand () { 
    sudo -n uptime 2>/dev/null 1>/dev/null
  local bSudoOn=`if(($?==0));then echo true; else echo false; fi`

    history -a; # append to history at each command issued!!!
    local width=`tput cols`;
    local half=$((width/2))
    local dt="[EndAt:`date +"%Y/%m/%d-%H:%M:%S.%N"`]";
  if $bSudoOn; then dt="!!!SUDO!!!$dt"; fi
    local sizeDtHalf=$((${#dt}/2))
    #printf "%-${width}s" $dt |sed 's" "="g'; 
    echo
    output=`printf "%*s%*s" $((half+sizeDtHalf)) "$dt" $((half-sizeDtHalf)) "" |sed 's" "="g';`

    local colorLightRed="\e[1;31m"
  local colorNoColor="\e[0m"
    if $bSudoOn; then
        echo -e "${colorLightRed}${output}${colorNoColor}"
    else
        echo -e "${output}"
    fi
}
export PROMPT_COMMAND=FUNCpromptCommand

At terminal type bash to test it. It will also add a whole line each time you execute a command, that has the information of the time the last command ended, so you can go lunch and know when the last command ended :).

You can play with this code to fit your needs. There is the PS1 variable also (that is the actual small prompt single line), but I think it is better to not mess with it.

PS.: for OS-X, look for the comment below by @nwinkler.

Answer 5

According to the sudo manual, the sudo session is determined according to the time stamp file (/usr/lib/sudo/<username>), so you may be able to figure out how much time is left by checking the date/time of the time stamp file. However, in my system, the time stamp file is in fact a directory, and there are three files with cryptic content in them (and also some weird time stamps, but /usr/lib/sudo/<username> seemed to have a timestamp that coincided with the time I gave sudo my password. I think /usr/lib/sudo/<username>/0 has the time stamp of the most recent sudo execution.

Answer 6

Warning

Acording to Bugzilla sudo Bug ID=590 the call to sudo -n true 2&>/dev/null ; echo $? will become buggy around sudo -V 1.7.10

Read Bugzilla [here](http://bugzilla.sudo.ws/show_bug.cgi?id=590"Bug ID=590")

Answer 7

At least on sudo 1.8.21p2, this approach works fine:

if sudo -vn 2> /dev/null; then
    echo "You have an active sudo session"
fi

Answer 8

This is probably extreme overkill by most people's standard, but here is the (posixly correct) function I use to check if sudo is unlocked (the function will not waste its time if the user running it is root, as there is no need to unlock sudo):

#!/bin/sh

_unlock_sudo() {
    if [ "$USER" != 'root' ]; then
        if ! sudo -n -- true 2>/dev/null; then
            printf '\n'
            printf 'Enter password for sudo user "%s":\n' "$USER"
            while ! sudo -- true; do
                printf '\n'
                while true; do
                    printf 'Slow your roll. Try to enter password again? [Y/n]: '
                    read -r answer
                    case "$answer" in
                        ''|y|Y|yes|Yes|YES)
                            printf '\n'
                            printf 'Enter password for sudo user "%s":\n' "$USER"
                            break
                            ;;
                        n|N|no|No|NO)
                            printf '\n'
                            printf 'OK. Exiting...\n'
                            exit 1
                            ;;
                        *)
                            printf 'Please enter a valid option...\n'
                            printf '\n'
                            ;;
                    esac
                done
            done
        fi
    fi
}

_unlock_sudo

Answer 9

Very old question but I have a solution that does not require the -s flag, and does not require temperamental string operations.

A good solution might be to exploit the fact that an unauthenticated sudo call hangs for a long time.

sudo date will return pretty much instantly if authenticated, but will hang if not.

The timeout command is placed before another command to limit how long it takes to execute, and exits with code 124 if it cuts the execution of the inner command short. You can check the exit code of the last command with echo $?

With that in mind...

timeout .1s sudo date
EXITCODE=$?

Now test if $EXITCODE is 127 or not and you have your answer :)

Answer 10

simple answer ...

sudo echo
isSudo=$?
if [[ "$isSudo" -ne 0 ]]; then
  echo "This script must be run by root or a sudo'er"
  echo
  exit 1
fi

# do stuff

exit 0

Answer 11

How about the man page

man sudo

List your available commands:

sudo -l

sudo itself has no time or date limits... see:

man sudo
man sudoers