Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to execute a bash script that switches user and then executes a series of commands. None of this users have root privileges. I guess I have to edit the sudoers file to give user1 (the user executing the script) privileges to be able to log as user2 with no password prompt. I've been looking for this example but I haven't found any.

Thanks in advance.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

In this example:

  • User running the script = fred
  • User the script wants to run certain commands as = boris
  • Commands the script wants to run as boris = /bin/cat & /bin/rm

In the sudoers file (visudo) have:

fred   ALL=(boris) NOPASSWD:/bin/cat, (boris) NOPASSWD:/bin/rm

Then in the script:

#!/bin/sh
sudo -u boris cat /home/boris/privatefile
sudo -u boris rm /home/boris/privaterubbish

If you want to allow fred to execute any command as boris use this in sudoers:

fred    ALL=(boris) NOPASSWD:ALL
share|improve this answer
    
You should consider reformatting the second paragraph, e.g. to a list. –  Daniel Beck Mar 29 '11 at 7:52
    
This is exactly what I'm looking for! –  eliocs Mar 29 '11 at 10:57

Put the series of commands in a file, make it start with #!/bin/sh, and make it executable. Then give the users permission to run that script with visudo.

Beware: this is likely to provide escapes for them to run any command. An alternative is to write a C program that executes the commands in question. Even then you need to watch your step, e.g. clean the environmentvariables the user could use to smuggle in ways to make your commands execute in ways you haven't anticipated.

share|improve this answer

The sudoers file is pretty self documenting in my experience; it's filled with comments and examples. You can get pretty granular with the permissions as @reinierpost mentioned, and you should be aware that you're effectively giving this user superuser permissions by authorizing them to use sudo.

If you're just looking to allow the user to run arbitrary commands you'll likely be adding something like:

origuser           ALL = (ALL) ALL 

or if you want to bypass the password prompt

origuser           ALL = NOPASSWD: ALL

As far as switching users go, you might use sudo -u [command] or sudo -u -i [command] if you need the 'destination' user's environment.

share|improve this answer
    
urk no - that will give origuser FULL ROOT ACCESS –  Majenko Mar 29 '11 at 7:52
    
you're right; i also noted that in my answer –  thatothermitch Mar 29 '11 at 7:58
    
full root access is not desired in my case. –  eliocs Mar 29 '11 at 10:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.