Editing root-writable files with only sudo rights

Question

Our sysadmins login to boxes using unprivileged accounts with sudo rights. I often, out of habit, open files in vim instead of sudoedit. I do not want to get into the habit of using sudoedit. My colleague suggested creating a vim symbolic link in the path that points to sudoedit. This just seems like a horrible idea to me.

I normally just :w /tmp/service.conf and then mv -i /tmp/service.conf /etc/

This seems clunky but I am almost inclined to say that I trust this process more than getting into the habit of using sudoedit or sudo vim.

Opinions?

Side note: We generally have easily accessible backups of these files so that is not a concern.

Answer 1

I would just keep using VIM, and make it do the work for you. When you open a file that you don't have write access to, you can still save it by issuing the following in VIM: <ESC>:w !sudo tee %

This will allow you to execute sudo, and tee your edits into the file you are currently editing. After you do this, the file is effectively edited outside of VIM, so it will ask you to load the new contents.

Answer 2

With sudo.vim, you can do vim sudo:path-to-file. If you've already opened a file without sudo:, you can do :f sudo:% to switch to using sudo to read/write. (You may want to :set noro too, to avoid warnings when you try to edit/write the file that Vim thought was read-only when first opened.)

Be warned that both Alex's :w !sudo tee % solution and sudo.vim suffer from shell escaping issues. Do not use unless you know that the filenames are safe.

Answer 3

If you have sudo rights such that you can run any command as root, sudoedit doesn't really give any benefits. It exists so that otherwise unprivileged users can be safely granted the ability to edit certain files, without letting them run a whole editor as root in some sort of restricted mode (which is difficult to get right).

So, your approach seems fine, although I think remembering to type sudo vim isn't that awful, given that you need to type sudo whatever to execute other commands as root.

A note on your side-note: I think I'd be more worried about accidentally overwriting another file by accident (-i not withstanding — you're expecting to say "yes" to that question, so it's easy to get in the habit of doing so) than I would about munging the file you're intending to edit. So make sure you have a backup of everything else, as well.

Answer 4

sudo su -

Failing that, write a shell script, something like this. Note that it'll break if you want to pass arguments into vim (you could extend it to work though, it's more of a PoC)

#!/bin/sh
# Pretend to be vim, write to /tmp then sudo copy to original file
$TMPFILE = $(mktemp)
cp $1 $TMPFILE
vim $TMPFILE
sudo mv -i $TMPFILE $1

This might do what you're after? You could also easily set it up to create two copies of the file, and before doing the move, warn you if they're not still identical (meaning someone has since changed the original)