1

I have the strong feeling I'm trying to reinvent the wheel, but I did spend some time without finding an existing solution.

I have an already working shell script with several sudos. Its first target was admin users, so everything was ok. But now I'm hitting a roadblock for standard users. Sudo won't work, and as I must run this script on any machine any time, editing sudoers is not an option.

How can I rewrite this script so that it asks for admin user and password once, and then uses this credentials to run as many su as needed? What I'm particularly trying to do is feed password to one-line su but, security risk aside, I've never been able to use something as 'echo | su ...', as seen on forums.

Thanks

  • Does the script run longer than the timeout of sudo? – nohillside Dec 26 '18 at 13:15
  • That's not the question, any sudo in a script from a standard client terminal will trigger 'name is not in the sudoers file. This incident will be reported' – Arno Mad Dec 26 '18 at 13:35
  • That's not correct. Any user who's not in the sudoers file will trigger the error. It doesn't matter if you're logged in as a standard user or an admin. – Allan Dec 26 '18 at 13:59
  • Right, I have over-simplified. On a normal mac, standard users are not in the sudoers, while admins are. So the question is, how to avoid using sudo entirely? – Arno Mad Dec 26 '18 at 14:02
  • 1
    That's also not correct. On all Macs, Admins are in the wheel group which is in the sudoers file. No single user, admin or standard is in the sudoers file unless explicitly put there by someone. – Allan Dec 26 '18 at 14:18
2

Generally speaking, you write the script as if an admin will be executing it and you check to see if the user has root privileges to run it. In all of my bash scripts where the script needs root privileges, I have the following code snipit that validates if the user has the correct privileges:

# Validates that user is root; exits if not
echo "Checking Root Privileges"
if [ $(id -u) -ne 0 ]
  then exit 1;
  else echo "User is root";
fi

Basically, all it's doing is checking the UID is 0 for the currently logged in user. You can try it on the command line:

$ id -u                # My login
503

$ sudo id -u           # Root privileges
0

Running the script....

There are a couple of ways you can run the script from a login account that doesn't have admin privileges:

  • add them to the sudoers file or add them to the wheel group
  • add them to a group (besides wheel) that has sudo privileges
  • run the script remotely via ssh with admin credentials
  • run the script as a launchd plist as a Launch Daemon (runs as root)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .