I have a long and long-running bash script where a handful of commands need to be run as root while the majority of commands need to be run as the regular user before sudo, because it would mess up file ownership and such.

I came up with some methods, but each of them have some problems

Method 1: Using sudo inside the file

sudo echo "I must be run by root"
touch needsToBeOwnedByUser1
echo "needs to be run by user"
sleep 1000
sudo echo "I, again, must be run by root"

This would look good, from the way the code is written. sudo is written before the few statements that actually need to be run by root, but if the time between each sudo call is too long sudo again asks for a password. Also, if the first execution of sudo fails, e.g. due to an invalid password, the rest of the script is still executed.

Method 2: using sudo to call the file and then change back to the original user when needed

echo "I must be run by root"
su username -c 'touch needsToBeOwnedByUser1'
su username -c 'echo "needs to be run by user"'
su username -c 'sleep 1000'
echo "I, again, must be run by root"

This also sucks, because I need to add su username -c in front of almost every line. Also finding the original username after sudo is possible, but cumbersome.

Is there a better way?

Edit: I only posted small, nonsensical scripts here to show what I am talking about. In the actual script I have some lines that need sudo (starting and stopping services), some lines where it does not matter if there is sudo and quite a lot of lines that really need to be run without sudo.

  • 4
    This is very rarely needed. In most cases, you just run the script with sudo if it needs to have elevated permissions. But there's no point in switching to su username -c to run an echo. In other words, this sounds like an [XY]. Could you edit and explain what your script will actually be doing and why you feel you need to be switching users so often?
    – terdon
    Jul 25, 2017 at 12:26
  • 1
    @ElderGeek did you paste the wrong link? That doesn't even seem related. This probably is a duplicate of How do I run 'sudo' command inside a script? but I hope the OP can explain a bit more.
    – terdon
    Jul 25, 2017 at 12:27
  • @terdon It would seem so. Cleaning up.
    – Elder Geek
    Jul 25, 2017 at 12:41
  • This is just an example script. I didn't want to paste a 200+ line script in here. I will edit the answer for more details.
    – Dakkaron
    Jul 25, 2017 at 12:48
  • Have you considered the validate option, which is described in man sudo? -v, --validate 'Update the user's cached credentials, authenticating the user if necessary. For the sudoers plugin, this extends the sudo timeout for another 15 minutes by default, but does not run a command. Not all security policies support cached credentials.' (If you run it often enough, the sudo authenticating should not timeout.)
    – sudodus
    Jul 25, 2017 at 12:51

3 Answers 3


Regarding method 2, it's easier to use a function. For example:


    echo "Username: $USER"
    echo "    EUID: $EUID"

export -f func

su "$SUDO_USER" -c 'func'

$SUDO_USER is the sudoer's username. You could also use $(logname) in its place.

Running on my machine:

$ sudo bash test.sh
[sudo] password for wja: 
Username: root
    EUID: 0
Username: wja
    EUID: 1000
  • in my case this does not work:zsh:1: command not found: func
    – PiKey
    Sep 8, 2020 at 22:30
  • @PiKey Well, it's written for Bash, not Zsh. Is the :1 there referring to the function definition (func(){) or the call from su (-c 'func')?
    – wjandrea
    Sep 8, 2020 at 22:37

By reading man sudoers, one sees:


   By default, sudo requires that a user authenticate him or herself
   before running a command.  This behavior can be modified via the
   NOPASSWD tag.  Like a Runas_Spec, the NOPASSWD tag sets a default for
   the commands that follow it in the Cmnd_Spec_List.  Conversely, the
   PASSWD tag can be used to reverse things.  For example:

   ray     rushmore = NOPASSWD: /bin/kill, /bin/ls, /usr/bin/lprm

   would allow the user ray to run /bin/kill, /bin/ls, and /usr/bin/lprm
   as root on the machine rushmore without authenticating himself. 

Thus, you could allow regular on host machine1 to execute command1 and command2 as root, without password authentication with:

reguser machine1 root = NOPASSWD: /usr/local/command1, /usr/local/command2  

but read each of man -k sudo for details.


Maybe this can help:

chmod 775 yourscript.sh

Then you can use sudo inside of the script (without password prompt) And can not use sudo for other commands inside your script.

  • 1
    I fear that does not work. chmod 775 only allows you to execute the file and does not change the user which is executing the file or their rights.
    – Dakkaron
    Apr 14, 2020 at 8:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .