Can I run "su" in a shell script?

[DixieFlatline]

Hi all,

Does anyone know how to run su inside a shell script? I need to mv a file that needs root access. Is there a way to run su non-interactivly so I can do it in a script?

 

[chgwhat]

Check out sudo or super to mv the file as root.

 

[fenris]

I have about a years worth of experience with linux but you may be able to set the script to run with root permission something like chmod 711 filename. Make sure the owner of the file is root chown root.root filename and this may work.

 

[AndyBo]

Troy, doing as you suggest will make the script be owned by root, but it will still run with the permissions of your current user. You used to be able to set the setuid bit on the script so that it would run as root, but you can no longer do this.

(Quick aside to explain why: I create a script that contains the line "rm -fr /". I then set the setuid bit, and I run "chown root mybadscript". Run the script and wave goodbye to your files...)

If the program was a compiled binary, then setting the setuid bit would work. This being a shell script, though, it won't.

Using the "sudo" package will solve the problems. It lets you run scripts as the super-user by running "sudo /my/script". The default behaviour is for the user to be asked for a password. However, you can set things up so that the script is run as root without being prompted for a password.

If you do decide to do this, then you must be 100% certain that the sudoers file does not allow other scripts to be run in the same way. You also need to be 100% certain that the script you are running cannot be compromised. In other words, can I login as a normal user, create a script that will cause damage to the system, and then copy it over the top of the existing, safe, script? If the answer is no, then that's half the problem solved.

There are stacks of documentation provided with sudo, and it is very easy to set it up in a secure way. For that reason, that is the method I would suggest.

Hope this helps.

 

[DixieFlatline]

I actually post this on the wrong forum... oops
I can't us sudo cause I am running this in SCO not linux...
I seem to have solved the problem by running the script as root, and su as the other account to do other things so su doesn't ask for a password. Thanks anyway.

 

[fenris]

Thanks for the explaination Andy, I appreciate it. BTW I noticed the setuid bit thread in the linux servers forum. I almost posted there asking about this type of problem

 

[AndyBo]

Dixie, you can get a version of sudo for SCO from the Skunkware CDs. If you want to download from the SCO site, the OSR5 package is at

http://www.sco.com/skunkware/osr5/sysadmin/sudo/

However, I've also successfully compiled it from the source code under UnixWare 2.1.3 and UnixWare 7.0.1. Post back if you want me to mail the binaries to you.

Troy, always glad to help For some reason, SUID questions always seem to come in pairs ;^)