CODEWITHSUNDEEP
bash
seininn
seininn

Reputation: 431

Run a command without privileges in a root shell

I have a script that runs with root privileges, and I have a command that must not be run with the those privileges that is executed by the script. I need a way to run that command without those privileges.

From what I've been able to determine, I can run a command as another user using tools like sudo. But doing so requires the knowledge of the user name (or ID) that is to be used before hand. This also raises one or two security issues.

My question is: Is it possible to simply run that command as root but without the elevated privileges? if not, are there suitable alternatives?

Upvotes: 2

Views: 4119

Answers (3)

Keith Thompson
Keith Thompson

Reputation: 263637

My question is: Is it possible to simply run that command as root but without the elevated privileges?

No. The entire point of the root account is that it has full privileges. In fact the point of any account is the privileges that it has. The way to run without root privileges is to run as a user other than root.

If not, are there suitable alternatives?

See the other answers. You have to run the command from some specific non-root account, which means that you have to know the name (or numeric UID) of some other account.

As Adam Zalcman suggests, the nobody account might be suitable. Or you can read /etc/passwd or equivalent to find a valid account (though running as some random real user might cause problems).

For that matter, since you have root privileges, you can (temporarily?) create a new account for the purpose of running the command. That's probably overkill, though.

The simplest solution is just to find a way to specify a non-root account.

Upvotes: 1

Adam Zalcman
Adam Zalcman

Reputation: 27233

You can indeed use sudo to run the command with lowered privileges like this:

sudo -u USERNAME COMMAND

or better

sudo -u USERNAME -g GROUPNAME COMMAND

Note that this will require proper entries in the sudoers file.

If you don't know the name of a user and would like to just run the command with some lowered privileges you can use user nobody and group nobody or nogroup for that.

Upvotes: 4

SiegeX
SiegeX

Reputation: 140537

su <non-root-user> -c 'some_command'

Upvotes: 2

Related Questions