Temporarlly increasing sudo's timeout for the duration of an install script

Question

I'm trying to write a script, that will install a bunch of software, I'd like to not have to run everything as root, so I'd like to be able to prompt for a password and then go about the install, using sudo or su to get privileges when I need them.

I was doing a sudo -v to prompt for a password at the beginning of the script, and then just using sudo normally later on. This works great until I get to a single install that takes over the timeout.

I'd rather not have to permanently increase the timeout, is there a way I can increase sudo's timeout for the current session only?

Answer 1

You can setup a loop that runs in the background to periodically execute "sudo -v", the trick of course is getting the loop to cleanly terminate when your script terminates. So there has to be some type of communication between the two processes; tmp files are fine for this, and they can easily be cleaned up after the script runs, too. (An install script usually does this, anyway.)

For example (remove the 'echo' statements to use this; these just show it "working"):

#!/bin/bash
log=running_setup.txt
sudo_stat=sudo_status.txt

echo "========= running script $$ ========"
echo $$ >> $sudo_stat
trap 'rm -f $sudo_stat >/dev/null 2>&1' 0
trap "exit 2" 1 2 3 15

sudo_me() {
 while [ -f $sudo_stat ]; do
  echo "checking $$ ...$(date)"
  sudo -v
  sleep 5
 done &
}


echo "=setting up sudo heartbeat="
sudo -v
sudo_me

echo "=running setup=" | tee $log
while [ -f $log ]
do
 echo "running setup $$ ...$(date) ===" | tee -a $log
 sleep 2
done

# finish sudo loop
rm $sudo_stat

Then you'll see... (note: the pid is put into the tmp file, just so you can easily kill it. It's not necessary, though):

$ ./do_it.sh
========= running script 6776 ========
=setting up sudo heartbeat=
[sudo] password for user: 
=running setup=
checking 6776 ...Wed May  4 16:31:47 PDT 2011
running setup 6776 ...Wed May  4 16:31:48 PDT 2011 ===
running setup 6776 ...Wed May  4 16:31:50 PDT 2011 ===
running setup 6776 ...Wed May  4 16:31:52 PDT 2011 ===
checking 6776 ...Wed May  4 16:31:53 PDT 2011
running setup 6776 ...Wed May  4 16:31:54 PDT 2011 ===
<ctrl-c>  (cleans up files, then exits)

Answer 2

According to the sudo man page:

   -v          If given the -v (validate) option, sudo will update the user's time stamp,
               prompting for the user's password if necessary.  This extends the sudo timeout for
               another 15 minutes (or whatever the timeout is set to in sudoers) but does not run
               a command.

So I guess that if you add some sudo -v in more points of your setup script to validate the session (and not only at the beginning) you will get what you want, since each time it will increase the timeout (it only asks the password again if the timeout is reached). The only problem will be if there's a command on your script that takes more time than the timeout (so even if you validate right after it the timeout will expire before it completing for another validation), but this is a very specific case.

What happens is that just using sudo doesn't increase the timeout, and sudo -v doesn't execute a command, so you have to use sudo -v more times to validate the session.