44

I'm trying to write a bash script (in Ubuntu) that will backup a directory using tar.

How can I do a check in the script so that it can only be run as root (or with sudo)?

For instance, if a user runs the script, it should say that this script must be run with sudo privileges, and then quit. If the script is executed as root, it will continue past the check.

I know there has to be an easy solution, I just haven't been able to find it by googling.

2
  • 1
    Recently, I've seen things like systemd elevate privileges automatically with user password entered. I'd be interested in an answer that can not only alert the user they don't have the needed permissions, but offer to elevate it for them instead of forcing a restart.
    – flickerfly
    Feb 5, 2021 at 18:40
  • came here looking for something like that. I'm building up a script which has sudo usage in the middle of it... would be nice to get it right from the start, but none of the solutions presented here so far have worked (both id -u and sudo id -u come out as "1000" instead of 0) Feb 8, 2023 at 14:51

7 Answers 7

57

To pull the effective uid use this command:

id -u

If the result is ‘0’ then the script is either running as root, or using sudo. You can run the check by doing something like:

if [[ $(/usr/bin/id -u) -ne 0 ]]; then
    echo "Not running as root"
    exit
fi
5
  • 7
    I'd recommend fully-qualifying the path to id (e.g., /usr/bin/id). Otherwise a devious user could write their own script/binary that always returns 0 and then put it in a location that exists earlier in the executing users' path.
    – ktower
    Jul 8, 2009 at 17:57
  • Agreed. Fixing with an edit.
    – Scott Pack
    Jul 8, 2009 at 18:05
  • 9
    Anyone 'devious' trying to run the script won't be stopped by you using the full path to id. Jul 8, 2009 at 18:14
  • I agree with theother... it's a bash script. Qualifying the 'id' bin won't stop anyone who is seriously intent on getting around the check anyway. Better to leave it unqualified for portability.
    – Chris
    Jul 22, 2009 at 11:37
  • 3
    This doesn't address the "sudo" requirement.
    – GregB
    May 9, 2012 at 18:14
21

I assume you know that by changing the ownership to root

chown root:root file

and setting the permissions to 700

chmod 700 file

you will accomplish the same thing - without the suggestion to run as sudo.

But I will post this answer for completeness.

2
  • 4
    This is a more appopriate solution than the accepted answer. - My $0.02
    – Chris
    Jul 22, 2009 at 11:38
  • Side note: checking the script into git becomes harder. To fix, sudo git add <file> Oct 30, 2016 at 21:35
12

The bash variable $EUID shows the effective UID the script is running at, if you want to make sure the script runs as root, check wether $EUID contains the value 0 or not:

if [[ $EUID -ne 0 ]]; then
    echo "$0 is not running as root. Try using sudo."
    exit 2
fi

This is better than the solution with /usr/bin/id (for bash scripts!) because it doesn't require an external command.

3
  • 2
    Instead of just exiting, could prompt the user for sudo login by replacing the echo line with sudo "$0" "$@", and replace exit 2 with exit $?. Apr 15, 2015 at 20:35
  • Good idea. However the question asked for a script that quit, not ran sudo by itself.
    – neuhaus
    Dec 6, 2019 at 10:07
  • Instead of starting a subprocess and forwarding the exit status, just replace the current process with the privileged one using exec (e.g., exec sudo "$0" "$@").
    – ardnew
    Mar 6 at 18:27
3

You can use whoami command as well.

if [ ! "`whoami`" = "root" ]
then
    echo "\nPlease run script as root."
    exit 1
fi
1
  • 1
    Actually the uid 0 is the special user account with full privilege. "root" is simply the most common label/name mapped to that UID. It doesn't have to be 'root' and an attacker may try to exploit this.
    – 0xSheepdog
    Jul 21, 2016 at 20:11
2

What is your objective here, to inform the user that they should run the script as root or as some kind of security precaution?

If you just want to inform the user than any of the uid suggestions are fine, but they're as useful as tyres on a horse as a security precaution - there's nothing to stop a user from copying the script, taking out the if statement, and running it anyway.

If this is a security issue then the script should be set to 700, owned by root:root, so that it is not readable or executable by any other user.

1
  • 2
    Or, it could be the script requires access to files or commands only accessible to root in order to carry out its work, as in my case Sep 30, 2011 at 15:01
1

One simple way to make the script only runnable by root is to start the script with the line:
#!/bin/su root

-1

"#!/bin/su root" allows users in super user mode to run the script without using the root password. If you want super users to run the script with results that of root, this does that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .