Running Complex Commands with sudo

March 30th, 2009 by Don Marti in

Your rating: None Average: 4.6 (25 votes)

If you use sudo to run commands as root, you've probably run into “permission denied” problems when only part of a pipeline or part of a command is running with root permissions.

This fails with “permission denied” because the file is writable only by root:

$ echo 12000 > /proc/sys/vm/dirty_writeback_centisecs

But, this fails too:

$ sudo echo 12000 > /proc/sys/vm/dirty_writeback_centisecs

Why? The /bin/echo program is running as root, because of sudo, but the shell that's redirecting echo's output to the root-only file is still running as you. Your current shell does the redirection before sudo starts.

The solution is to run the whole pipeline under sudo. There are a couple ways to do it, but I prefer:

echo "echo 12000 > /proc/sys/vm/dirty_writeback_centisecs" | sudo sh

That way, I can type everything before the pipe character, and see what I'm about to run as root, then press the up arrow and add the | sudo sh to do it for real. This is not a big deal for short, obvious pipelines, but when you're building up a more complicated command as root, it's safer to look at it first before you run it.

__________________________


Special Magazine Offer -- Free Gift with Subscription
Receive a free digital copy of Linux Journal's System Administration Special Edition as well as instant online access to current and past issues. CLICK HERE for offer

Linux Journal: delivering readers the advice and inspiration they need to get the most out of their Linux systems since 1994.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
boediger's picture

Why? The /bin/echo program

On April 18th, 2009 boediger (not verified) says:

Why? The /bin/echo program is running as root, because of sudo, but the shell that's redirecting echo's output to the root-only file is still running as you. Your current shell does the redirection before sudo starts.

The solution is to run the whole pipeline under sudo. There are a couple ways to do it, but I prefer:

boediger

Anonymous's picture

A whole article decribing a

On April 12th, 2009 Anonymous (not verified) says:

A whole article decribing a single command line method? Surely more thought could have gone into this.

K31th's picture

A whole article decribing a

On April 6th, 2009 K31th (not verified) says:

A whole article decribing a single command line method? Surely more thought could have gone into this.

felipe's picture

tee shirts?

On April 4th, 2009 felipe (not verified) says:

man 1 tee
just as the above post explains, you can use tee. It is easier to visualise what's happening.

jpenny's picture

Proto's way is better.

On April 3rd, 2009 jpenny (not verified) says:

Sorry, bad cut and paste. Proto's method shows:

Apr 3 12:00:09 xxxxxxxx sudo: xxxxxxx : TTY=pts/22 ; PWD=/tmp ; USER=root ; COMMAND=/bin/sh -c echo 0 >/proc/sys/net/ipv4/ip_forward

First set of xxxxxxxx is machine name, second is userid.

jpenny's picture

Proto's way is better

On April 3rd, 2009 jpenny (not verified) says:

It gives better logging.

Using proto's method, auth.log shows:

Apr 3 12:00:12 xxxxxxxxx sudo: xxxxxxxx : TTY=pts/22 ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/tail /var/log/auth.log

Don's way just shows:

Apr 3 11:58:02 xxxxxxxx sudo: xxxxxxxx : TTY=pts/22 ; PWD=/tmp ; USER=root ; COMMAND=/bin/sh

Anonymous's picture

sudo: cd: command not found

On April 3rd, 2009 Anonymous (not verified) says:

The one that drives me crazy is when I'm trying to change to a directory with only root access:

john@p490:~$ cd /root
john@p490:/root$ cd .gconf
bash: cd: .gconf: Permission denied
john@p490:/root$ sudo cd .gconf 
sudo: cd: command not found

I always just give up at that point and change to the root user account with:

$ sudo su -

but I guess I could stack up the commands as shown above.

Proto's picture

I do the same with: sudo sh

On April 1st, 2009 Proto (not verified) says:

I do the same with:

sudo sh -c "echo 12000 > /proc/sys/vm/dirty_writeback_centisecs"

Barun's picture

I use the same one: sudo -c

On May 5th, 2009 Barun (not verified) says:

I use the same one: sudo -c ''. It is the more direct approach available, than using echo with sudo.

Gerald Marewo's picture

how about 'sudo -i' first?

On March 31st, 2009 Gerald Marewo (not verified) says:

how about 'sudo -i' first?

day spa gold coast's picture

I am totally agree with you,

On April 7th, 2009 day spa gold coast (not verified) says:

I am totally agree with you, It's really great.

Joe A's picture

another way

On March 30th, 2009 Joe A (not verified) says:

I like to use tee for this. Using your example, you could use
$ echo 12000 | sudo tee /proc/sys/vm/dirty_writeback_centisecs

This works for the same reason, it runs tee with sudo. You can also use
tee -a
to append to file instead of overwriting it.

Post new comment

Please note that comments may not appear immediately, so there is no need to repost your comment.
The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <pre> <ul> <ol> <li> <dl> <dt> <dd> <i> <b>
  • Lines and paragraphs break automatically.

More information about formatting options

Newsletter

Each week Linux Journal editors will tell you what's hot in the world of Linux. You will receive late breaking news, technical tips and tricks, and links to in-depth stories featured on www.linuxjournal.com.
Sign up for our Email Newsletter

Tech Tip Videos

From the Magazine

December 2009, #188

If last month's Infrastrucuture issue was too "big" for you then try on this month's Embedded issue. Find out how to use Player for programming mobile robots, build a humidity controller for your root cellar, find out how to reduce the boot time of your embedded system, and if you're new to embedded systems find out the basics that go into one. You can also read about the Beagle Board, the Mesh Potato and a spate of other interestingly named items. And along with our regular columns don't miss our new monthly column: Economy Size Geek.


Read this issue