When a user logs in I need to execute a command that needs escalated privileges. I don't want to give the user sudo access for that command. I just want to run this script for that user, not for all users.

  • There isn't a standard way, but there are ways to do this. An SUID script in the user's login script is one way, but then your question would need to say whether you wanted to prevent the user from altering his own login scripts. – msw Mar 27 '13 at 7:06
  • @msw I don't want user to be able to change this, ideally not even see what that script is doing. – Meer Borg Mar 27 '13 at 7:10

Based on your comment, it sounds like you want user 'fred' to not have a regular shell but run the script 'foo' upon login. This can be done easily if you don't expect Fred to try very hard to escape his "sandbox".

$ cat ~fred/.bash_login
exec /usr/local/bin/foo

## in ubuntu each user has a group of his "own"
$ sudo chown foo:fred ~fred ~fred/.bash_login /usr/local/bin/foo
## prevent fred from altering the files and directories we care about
$ sudo chmod g-w ~fred ~fred/.bash_login /usr/local/bin/foo
## make script foo run with user foo's privileges
$ sudo chmod u+s /usr/local/bin/foo 

So fred will now not even get a shell prompt because the first thing his login shell does is replace itself with foo; when script foo exits, fred will be logged out. The reason Fred should lack motivation to climb out of this sandbox is that many programs allow subordinate shells to be opened which would allow fred to undo the poor-man's lockout shown here.

Using this method with "root" instead of some non-superuser foo can be used to hijack root, so don't do that.

  • Info I can definitely use in other circumstances but it still alludes the run something as root in a safe way without user having sudo access or a way of escalating his privilege. In my case it would be a "root" command to change the brightness of the laptop when the user logs in. Example is irrelevant, point being user logs in and an escalated process needs to be run without him having escalated privileges given to him. – Meer Borg Mar 27 '13 at 23:06

I would use chmod 6755 filename (or 6711 if you dont want to be read by other users)and then put it in cron... This should work, as it is permission to run this file as owner. So, if you create it as root, you should be able to use it like this...

  • 1
    Cron jobs run on a schedule, not when the user logs in, or did I miss your point? – Meer Borg Mar 27 '13 at 7:12
  • 1
    my fault, if you put it in crontab, you can use flag @reboot – Štěpán Postránecký Mar 27 '13 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.