Prompt for sudo password and programmatically elevate privilege in bash script?

Question

I'm currently working on a bash script that installs and sets up various programs on a stock Linux system (currently, Ubuntu). Because it installs programs and copies a number of files to various folders that require elevated privileges, I've already done the standard "I need elevated privileges"-and-exit.

However, I would like, if possible, to be able to prompt the user for their sudo password and elevate the script's privileges automatically if the user doesn't run the script command with sudo (such as launching it from the GUI file manager), without the user having to restart the script.

As this is designed to run on stock Linux installs, any option that modifies the system won't work for my purposes. All options need to be contained to the script itself.

Is this possible within Bash? If so, what's the best (secure, yet concise) way to do this?

• Michael Mrozek: See also on AU: How to execute a script as super user first checking the user and getting pass from askpass if not super user
• Shauna: @MichaelMrozek - Ah, the joys of having so many niche sites while trying to minimize fragmentation. And you know, the link you gave never once came up for me while searching Google.
• user56041: Also see How to enter password only once in a bash script needing sudo, Request root privilege from within a script,Create a sudo user in script with no prompt for password..., sudo with password in one command line?, How to prompt user for sudo password?, etc
• Shauna: @jww you do realize that nearly all of those links were asked about 4 years after this one, right?
• user56041: @Shauna - I'm guessing you have solved the problem by now. The links are for future visitors.

Answer 1

I run sudo directly from the script:

if [ $EUID != 0 ]; then
 sudo "0ドル" "$@"
 exit $?
fi

• dessert: This will throw an error if EUID is not set for any reason – better quote it: [ "$EUID" != 0 ]
• dessert: For those wondering: EUID ("effective user ID") can be changed with setuid while UID can not.
• Sebastian Simon: It seems that something like sudo "$BASH_SOURCE" $(printf '%q ' "$@") is a safer alternative, according to this comment.
• xeruf: @SebastianSimon but it's bash-specific, while the script in the answer is POSIX-compliant
• Ben: @SebastianSimon Do you know what "0ドル" "$@" actually gets wrong? The comment you linked claims it fails on whitespace and glob characters due to splicing an array into a string, but that is not true in my testing, and I thought the whole point of the special handling bash does with "$@" (rather than $@ or $*) is that it specifically handles properly expanding into a series of arguments with exactly the same contents, (regardless of whitespace within any of the arguments).

Answer 2

Add this as the first line of the script:

[ "$UID" -eq 0 ] || exec sudo bash "0ドル" "$@"

Change sudo to gksu or gksudo if you prefer a graphical prompt.

• wrongusername: Is there a way to do this on Debian, where there seems to be no sudo command?
• Kevin: @wrongusername install sudo, it's much better than using su. But if you really want, probably exec su -c "0ドル" "$@"
• gntskn: This also won't inherit any environment variables from the current shell; use exec sudo -E bash "0ドル" "$@" to get that behavior.

Answer 3

I suggest:

#!/bin/bash
if (($EUID != 0)); then
 if [[ -t 1 ]]; then
 sudo "0ドル" "$@"
 else
 exec 1>output_file
 gksu "0ドル $@"
 fi
 exit
fi
# some example stuff
ls -l /root
echo "app: 0ドル"
for f; do
 echo ">$f<"
done

• Shauna: What does if [[ -t 1 ]]; check for?
• Shauna: Ah, ok. I figured it had something to do with terminal vs GUI, but wasn't sure what the if statement itself was checking.

Answer 4

An example script that I don't mind sharing::

#!/bin/bash
[ "$UID" -eq 0 ] || exec sudo "0ドル" "$@" && echo -n "sudo bash what: "
read WHAT
sudo $WHAT

• groovenectar: [ "$UID" -eq 0 ] || exec sudo "0ドル" "$@" -- Looks like a really efficient one liner! Nice!
• groovenectar: Would it make sense to use Effective UID here, $EUDI, or always the same outcome? E.g., [[ "$EUID" -eq 0 ]] || exec sudo "0ドル" "$@"

Answer 5

I use visudo to edit the sudoers file as follows:

• In the line with your user, add this next to the username:

  ALL=(ALL) NOPASSWD: ALL
  

  then save.
• When that user

  sudo su -
  

  he will be logged on as root without entering a password.