/usr/local/bin I've the following script called
/usr/local/bin$ cat sdown #!/bin/bash if [ $# -lt 1 ]; then echo "no time set" else sudo shutdown -h $1 fi
Permssions are 788:
-rwxr-xr-- user user sdown
The point is if I run the script it's prompting for the sudo password:
/usr/local/bin$ sdown 13:37 [sudo] password for user:
Just to make my life even better I'd like to avoid typing in my password for shutting down the computer. I think there're to possibilities I could look for:
- Allowing execution of the
shutdowncommand without prompting for sudo rights. (sudoers file or so... ?)
- Find a away to grant sudo permission to the script so I could drop the sudo in there.
Probably the first way is easier and on my private machine I can do that. However I wonder what if I come in another situation. Though it's theoretic I'd like to learn best practise.
I wonder if it's better to grant permission for a specific script I write and therefore know what it does and what not instead of removing the sudo password protection for a full command (in this case
shutdown. Is this possible?
Also in this scenario I guess I've to consider the possibility of code injection by having some manipulating the script. I guess therefore I should change owner and group to root and just allow execution but not grant read and write access for other users.
(Or just for the group in case for more specific solutions.) However what about the possibility of someone exchanging the full file with some of it's own and therefore acquiring sudo rights?