Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is there any way with which, using shell scripts, I can execute a program as another user, in a uniquely(randomly) named directory, where the user has rwx access to all the files in that directory, but cannot change anything outside it.

i.e. When a program is executed using this script in a folder, it can only access files inside the folder and cannot change any system settings or navigate outside this folder

share|improve this question
    
Looks like you want to prevent a script walking up the directory tree. That can be done with chroot, but that's not usuable for shellscripts since binaries outside this directory will be unreachable after a chroot. Python or perl might be better suited for this task. What are you trying to achieve? –  Lekensteyn Apr 10 '11 at 11:43
add comment

2 Answers

up vote 2 down vote accepted

You could use rbash (or bash -r): it is a restricted version of bash that imposes some limitations to the user with respect to full bash. From rbash man page:

It behaves identically to bash with the exception that the following are disallowed or not performed:

   o      changing directories with cd
   o      setting or unsetting the values of SHELL, PATH, ENV, or BASH_ENV
   o      specifying command names containing /
   o      specifying a file name containing a / as an argument to the . builtin command
   o      Specifying a filename containing a slash as an argument to the -p option to the hash builtin command
   o      importing function definitions from the shell environment at startup
   o      parsing the value of SHELLOPTS from the shell environment at startup
   o      redirecting output using the >, >|, <>, >&, &>, and >> redirection operators
   o      using the exec builtin command to replace the shell with another command
   o      adding or deleting builtin commands with the -f and -d options to the enable builtin command
   o      Using the enable builtin command to enable disabled shell builtins
   o      specifying the -p option to the command builtin command
   o      turning off restricted mode with set +r or set +o restricted.

To use rbash trasparently, start your script with #!/bin/rbash.

Hope this help.

share|improve this answer
add comment

Use:

sudo -u USERNAME

EDIT: To use this command without entering password, use:

echo PASSWORD | sudo -u USERNAME COMMAND

Replace PASSWORD with the password of USERNAME. Replace USERNAME with the username. Replace COMMAND with the command you want to execute.

For example:

echo password123 | sudo -u daniel cp ./file ./dir/filecopied

I hope this helped you, Daniel

share|improve this answer
1  
You'd better run sudo visudo to edit the /etc/sudoers file and add a NOPASSWD for the command instead of writing the password in the script. –  Lekensteyn Apr 10 '11 at 11:41
    
@Lekensteyn Make it a separate answer. –  Adam Byrtek Apr 10 '11 at 22:09
    
@Adam Byrtek: the question needs additional details. In the current form, the answer would be "no, it is not possible". For usage instructions on NOPASSWD and visudo, see this question with instructions on running mount as root without a password. Note that the script will be run as root. –  Lekensteyn Apr 11 '11 at 12:58
    
On a side note. By default, sudo does not read the password from stdin, it reads it directly from the terminal, so echo PASSWORD | sudo -u USERNAME COMMAND will not work. Just run the script as root. With the default sudoers, root can run commands as any user without requiring a password. –  geirha Apr 17 '11 at 9:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.