Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have to write a script on ubuntu and some commands require root privileges. The script is full of normal linux commands. Is it possible to write a switch user(su) script that automates the password prompt without needing user intervention?. Need help...

I forgot to tell you that I'm asked to disable sudo access to all users and I did that. Alternate option?

Thank you!

share|improve this question

6 Answers 6

you should use sudo. In the file /etc/sudoers you can configure the commands which should be run with root privileges and whether a password is needed or not.

share|improve this answer

Try 'bash -p', if -p not given then bash will keep the original uid/gid even if suid.

share|improve this answer
    
But I do agree, you probably should not solve it this way ;). –  3molo Sep 17 '10 at 11:31
    
you mean to say just type 'bash -p'? and this way I didn't see any output and it is not changed to root user. –  user53864 Sep 17 '10 at 11:46
    
Sorry I misunderstood the question. If you were to create a suid bash, the bash -p would work. but like someone mentioned earlier, you cannot suid shell scripts –  3molo Sep 18 '10 at 8:24

As you said, you are unable to use sudo, you may think the other way around. Are you able to run the script as root and su to an user with lesser permission for the parts which do not need to be run as root?

As already said, sudo is exactly what you need and the best solution (you know, that you can limit sudo access for each command separate?)

share|improve this answer

Have a look at sudo. With this you can run specific commands with root privileges with or without the requirement to give a password.

It should already be installed on your Ubuntu system

EDIT

Sudo has been designed to do exactly what you want in a secure, controlled and auditable manner. The safest thing to do is to allow users to run the script via sudo. This doesn't then allow users access to the individual commands.

Discussion with the policy maker's should ensue.

Edit 2

You have to grant a user permission to run a particular shell via sudo before they can successfully run sudo -s. Just giving a user permission to run your script does not grant permission to run sudo -s.

share|improve this answer
    
I forgot to tell you that I'm asked to disable sudo access to all users and I did that. Alternate option? –  user53864 Sep 17 '10 at 11:15

The approach you describe would require that anyone who could run the script would be able to read the script - and hence the root password.

I'm asked to disable sudo access to all users

! you've been asked to disable the sub-system which has been specifically designed by some very smart people to provide limited root access to designated users and now you need to provide root access to designated users with your own home grown solution (and have proposed a very bad way of solving the problem).

You could set the sticky bit on the file permissions - but it'd take a very long time to go into the implications of doing that - and it seems that neither you nor the person who asked you to disable sudo really understand the Unix permissions model.

Why not just lose the pretence and give the users the root password?

share|improve this answer
    
The main reason to disable sudo is to tighten the security as any one can use the command "sudo -s" and gain acces to root by entering his own password. –  user53864 Sep 17 '10 at 12:25
    
@user53864: You can selectively enable commands and their options using settings in /etc/sudoers (use visudo to edit). –  Dennis Williamson Sep 17 '10 at 12:53

Do your own wrapper:

/* mywrapper.c */
#include <unistd.h>

extern char **environ;

main() {
    environ=NULL; /* clear environment variables for sanity */
    setuid(0);
    return execl("/usr/local/bin/script.sh", "script.sh", NULL);
}

Then gcc -o mywrapper mywrapper.c ; chown root mywrapper; chmod u+s mywrapper and you're ready to go.

share|improve this answer
    
That's a workaround for the shell resuming normal privileges when running a setuid script - not a solution to the OPs problem –  symcbean Sep 18 '10 at 9:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.