I need to run a command as a different user in the %post section of an RPM.
At the moment I am using a bit of a hack via python but it can't be the best way (it does feel a little dirty) ...
%post -p /usr/bin/python
import os, pwd, subprocess
os.setuid(pwd.getpwnam('apache')[2])
subprocess.call(['/usr/bin/something', 'an arg'])
Is there a proper way to do this?
If /usr/bin/something is something you are installing as part of the package, install it with something like
attr(4755, apache, apache) /usr/bin/something
When installed like this, /usr/bin/something will always run as user apache, regardless of what user actually runs it.
The accepted answer here is wrong IMO. It is not often at all you want to set attributes to allow anyone execute something as the owner.
If you want to run something as a specific user, and that user doesn't have a shell set, you can use su -s to set the shell to use.
For example: su -s /bin/bash apache -c "/usr/bin/something an arg"
I'm experiencing this really weird issue which I just can't understand why it is happening. When I execute following command from my shell manually it works.
sudo -u some-user echo "$SSH_KEY" | /home/some-user/.ssh/authorized_keys
however from a bash script it fails with a message we don't have any permissions.
#!/bin/bash
sudo -u some-user echo "$SSH_KEY" | /home/some-user/.ssh/authorized_keys
Is there any bash option to configure, or can someone explain this behavior?
It looks a bit like a bash security thingy for non interactive terminals or something like that, but I lost my creativity to google for the solution.
I'm running Ubuntu 16.04.
After hours of investigation it seems sudo commands where not executed because of the password prompt which does not occur from the script.
The solution was to first run a sudo command before runnning the script or just runnning the whole script as sudo so you can enter the password one time and the other sudo commands are running without password prompts.
I have a user, who's a passwordless sudoer. I need to execute shell script file with him, and make him execute one block as sudo. E.g:
su root <<"AS_ROOT"
# do something with my linux
AS_ROOT
But nothing works. I tried:
su - root <<...
sudo -s -- <<...
It barks back at me. I'm on ubuntu 16.04 lts.
Thank you.
As Cyrus points out, su is a different utility to which sudo's configuration doesn't apply.
It sounds like you're looking for something like this:
sudo -s <<'AS_ROOT'
echo "Hi from $USER."
AS_ROOT
This should output Hi from root.
Note that -s is needed to tell sudo to create a shell in order to interpret the commands passed via stdin (the here-doc). That shell is the current user's default shell, as reflected in environment variable $SHELL.
So I have a user, userA on Ubuntu. When the machine starts I want to add a script to /etc/rc0.d called startService
From inside of this script it will start several services using three scripts
startServiceA.sh
startServiceB.sh
startServiceC.sh
I'd like those three scripts to be started from userA, not root. How would I achieve this?
You can use commands like: su, sudo, runuser
Be sure to check the man pages.
This site might be able to help you also
http://www.cyberciti.biz/open-source/command-line-hacks/linux-run-command-as-different-user/
You can run commands inside your startup script with:
sudo -u <username> ....
Note: you will need to to preface every command in the file that you want to run as another user. I'd recommend making a variable at the top of your script like so:
SUDO="sudo -u <username>"
Then just do: $SUDO <command>
I need use execute a command inside of a script in a Run Script build phase in Xcode 4 using sudo. However, the compiler complains:
sudo: no tty present and no askpass program specified
Anyone have a clever solution for this problem?
One solution is to place the sudo password in an executable shell script like the following:
#!/bin/bash
echo thesudopassword
This shell script might be called password.sh
Then, setup the environment variable SUDO_ASKPASS=password.sh
Once this is setup, the -A option can be passed to sudo. This option uses the ASKPASS program to obtain the sudo password. The ASKPASS program need only write the password to stdout.
So, for example,
sudo -A ditto -V /tmp/testserver.dst /
This is obviously a rather insecure solution, but it does work.
Two ideas that haven't been suggested yet, both of which are probably better/safer than the currently accepted answer:
First option would be to put the part of the script that needs to be run as root in a script file (.sh or something), and then make it setuid as root: chmod go-w,+sx scriptfile, sudo chown root scriptfile. This means that script will automatically run as root, which avoids you needing to authenticate to run it (just to change it). As long as its operation isn't subject to user input, this should be quite safe. (Of course, if you make a script that takes an input argument and deletes it or runs it, or does most anything else with it, that would not be safe.)
Second option would be to use applescript (possibly via osascript). Applescript allows you to do shell script "sudo command goes here" with administrator privileges, which will pop up a graphical dialog asking for a password.
The first of these options would be good for an automated environment, though it might not deal well with (for example) being checked into an SCM, or being sent to another user. The second option would work better with that, but requires a password input every time, so doesn't work as well for an automated build script.
Another solution to this problem is to modify sudoers file and add your account to it and state that you should never be asked for the sudo password. To accomplish this is fairly straightforward:
run:
sudo visudo
In the User privilege specification section add a line that looks like
youraccountname ALL=(ALL) NOPASSWD: ALL
Of course, this can be a dangerous thing to do, so be careful. I would suggest reading the man page for sudoers and visudo before going this route.
After much searching I found the following solution.
https://forum.juce.com/t/build-script-for-automatically-moving-built-aus-into-components-folder-xcode/13112
Summary
Create a keychain and store your admin password in the keychain
Create a script which uses /usr/bin/security to access the password In your run script,
Set the ASK_PASS env variable and use the -A option with sudo
You can either run commands directly as a administrator with the following (changing echo YourCommandHere > /tmp/hello to your command):
osascript -e 'do shell script "sudo echo YourCommandHere > /tmp/hello " with administrator privileges'
Or run a script in your source directory using:
osascript -e 'do shell script "bash -x $SOURCE_ROOT/MyAdminScript.sh 1>/tmp/build-log 2>/tmp/build-log.err" with administrator privileges'
This runs the script and logs it output to /tmp/build-log and /tmp/build-log.err
For useful variables in the script see https://help.apple.com/xcode/mac/8.0/#/itcaec37c2a6
You can also execute XCode giving it the project as parameter from the Terminal using sudo like this:
sudo /Developer/Applications/Xcode.app/Contents/MacOS/Xcode /path/to/your/project.xcodeproj
This is the easiest solution I could think of, but there may be some drawbacks, since you would be executing XCode as root.
No need to write your sudo password anywhere. Just open a terminal window and type
$ sudo echo "hello"
Once you've typed your password, it will be good for a while - not sure how long - and the shell spawned by Xcode will inherit this permission.
If you get the "no tty present" message again later, just repeat the procedure