25

I'm trying to write a bash script (in Ubuntu) that will backup a directory using tar.

How can I do a check in the script so that it can only be run as root (or with sudo)?

For instance, if a user runs the script, it should say that this script must be run with sudo privileges, and then quit. If the script is executed as root, it will continue past the check.

I know there has to be an easy solution, I just haven't been able to find it by googling.

37

To pull the effective uid use this command:

id -u

If the result is ‘0’ then the script is either running as root, or using sudo. You can run the check by doing something like:

if [[ $(/usr/bin/id -u) -ne 0 ]]; then
    echo "Not running as root"
    exit
fi
  • 5
    I'd recommend fully-qualifying the path to id (e.g., /usr/bin/id). Otherwise a devious user could write their own script/binary that always returns 0 and then put it in a location that exists earlier in the executing users' path. – ktower Jul 8 '09 at 17:57
  • Agreed. Fixing with an edit. – Scott Pack Jul 8 '09 at 18:05
  • 6
    Anyone 'devious' trying to run the script won't be stopped by you using the full path to id. – theotherreceive Jul 8 '09 at 18:14
  • I agree with theother... it's a bash script. Qualifying the 'id' bin won't stop anyone who is seriously intent on getting around the check anyway. Better to leave it unqualified for portability. – Chris Jul 22 '09 at 11:37
  • 1
    This doesn't address the "sudo" requirement. – GregB May 9 '12 at 18:14
17

I assume you know that by changing the ownership to root

chown root:root file

and setting the permissions to 700

chmod 700 file

you will accomplish the same thing - without the suggestion to run as sudo.

But I will post this answer for completeness.

  • 3
    This is a more appopriate solution than the accepted answer. - My $0.02 – Chris Jul 22 '09 at 11:38
  • Side note: checking the script into git becomes harder. To fix, sudo git add <file> – Chaim Eliyah Oct 30 '16 at 21:35
2

What is your objective here, to inform the user that they should run the script as root or as some kind of security precaution?

If you just want to inform the user than any of the uid suggestions are fine, but they're as useful as tyres on a horse as a security precaution - there's nothing to stop a user from copying the script, taking out the if statement, and running it anyway.

If this is a security issue then the script should be set to 700, owned by root:root, so that it is not readable or executable by any other user.

  • Or, it could be the script requires access to files or commands only accessible to root in order to carry out its work, as in my case – chrisbunney Sep 30 '11 at 15:01
2

You can use whoami command as well.

if [ ! "`whoami`" = "root" ]
then
    echo "\nPlease run script as root."
    exit 1
fi
  • Actually the uid 0 is the special user account with full privilege. "root" is simply the most common label/name mapped to that UID. It doesn't have to be 'root' and an attacker may try to exploit this. – 0xSheepdog Jul 21 '16 at 20:11
1

The bash variable $EUID shows the effective UID the script is running at, if you want to make sure the script runs as root, check wether $EUID contains the value 0 or not:

if [ $EUID -ne 0 ]; then
    echo "$0 is not running as root. Aborting."
    exit 2
fi

This is better than the solution with /usr/bin/id (for bash scripts!) because it doesn't require an external command.

  • Instead of just exiting, could prompt the user for sudo login by replacing the echo line with sudo "$0" "$@", and replace exit 2 with exit $?. – schumacher574 Apr 15 '15 at 20:35
0

One simple way to make the script only runnable by root is to start the script with the line:
#!/bin/su root

-1

"#!/bin/su root" allows users in super user mode to run the script without using the root password. If you want super users to run the script with results that of root, this does that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.