3

Possible Duplicate:
How to run an application using sudo without a password?

I've made a script that preforms various system tasks, that I run regularly, but I have to use sudo to run the script, despite the fact that I own it because it runs root privileged commands. How can I add make sudo let me run this one file without having to enter my password every time I run it?

I know that there are questions regarding running commands without a password, but I wasn't able to find one on running a file without a password.

I am aware of the security risks, but I'm at home on a computer that I trust.

I added john ALL = NOPASSWD: /home/john/.script/hibernate.sh to my /etc/sudoers but when running the command sudo sh /home/john/.script/hibernate.sh it still prompts me for my password...

0

4 Answers 4

8

Use visudo for a safe editing environment to edit the sudoers file. This script is a wrapper around vi that also does syntax checking when you save the file and won't let you overwrite a valid sudoers file with an invalid one.

Add a line like this:

username ALL= NOPASSWD: /path/to/your/script

The "ALL=" bears some elaboration, it specifies that the permission is granted when the user in question is logged in from any location, locally (console or terminal) or remotely (ssh, etc).

5
  • For whatever reason, this method doesn't work. My username is john, and the file resides in ".script" which is inside my home. So i entered "john ALL = NOPASSWD: /home/john/.script/hibernate.sh" where hibernate.sh is the name of the script. After running "sudo sh /home/john/.script/hibernate.sh" it still asks for my password...
    – codesmith
    Oct 15, 2012 at 22:21
  • You need to make your .sh script executable and then just do "sudo /home/john/.script/hibernate.sh". The way you're trying to run it, john would need sudo permission to /bin/sh
    – Sparr
    Oct 15, 2012 at 22:34
  • the file is already executable, or at least is showed as such in nautilus > properties.
    – codesmith
    Oct 15, 2012 at 22:37
  • I just used chmod +rwx, and it still won't work...
    – codesmith
    Oct 15, 2012 at 22:42
  • the +x is step one. now change your command from "sh script" to "script"
    – Sparr
    Oct 15, 2012 at 23:25
3

For completeness sake, you can achieve a similar effect by setting setuid bit in the file's permissions.

A slightly tricky part is that for security reasons setuid bit on scripts is ignored by the kernel, so you'll need to compile a small wrapper program in C and use it to invoke your script. Save this as runscript.c:

#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main()
{
   setuid( 0 );
   system( "/path/to/script.sh" );

   return 0;
}

then compile it with

gcc runscript.c -o runscript

and set setuid bit on the executable:

sudo chown root:root runscript
sudo chmod 4755 runscript

It is also important to make sure your script is only writable by root, since everyone who can modify the script will be able to execute arbitrary programs:

sudo chown root:root /path/to/script.sh
sudo chmod 0711 /path/to/script.sh

Here's an article I've got the wrapper program code from: setuid on shell scripts.

Security-wise, both approaches - the one with sudo and the one with setuid - are pretty bad, but probably will be ok on a home machine. The difference is that every user in the system will be able to run a setuid command, even without being in the sudoers file. Also, obviously, you won't need to prefix the command with sudo.

0

You need the "NOPASSWD" tag.

Use visudo and set something like this at the end of the file:

username ALL=NOPASSWD: /bin/echo

Replace username with your username, and /bin/echo with the command you want to run.

0

You will need to add the full path to the program you're running to the sudoers file, not the script. I'm assuming it's pm-hibernate, so:

john ALL=NOPASSWD: /usr/sbin/pm-hibernate

Not the answer you're looking for? Browse other questions tagged .