Home ›

Running Complex Commands with sudo

Mar 30, 2009  By Don Marti
 in

If you use sudo to run commands as root, you've probably run into “permission denied” problems when only part of a pipeline or part of a command is running with root permissions.

This fails with “permission denied” because the file is writable only by root:

$ echo 12000 > /proc/sys/vm/dirty_writeback_centisecs

But, this fails too:

$ sudo echo 12000 > /proc/sys/vm/dirty_writeback_centisecs

Why? The /bin/echo program is running as root, because of sudo, but the shell that's redirecting echo's output to the root-only file is still running as you. Your current shell does the redirection before sudo starts.

The solution is to run the whole pipeline under sudo. There are a couple ways to do it, but I prefer:

echo "echo 12000 > /proc/sys/vm/dirty_writeback_centisecs" | sudo sh

That way, I can type everything before the pipe character, and see what I'm about to run as root, then press the up arrow and add the | sudo sh to do it for real. This is not a big deal for short, obvious pipelines, but when you're building up a more complicated command as root, it's safer to look at it first before you run it.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Why? The /bin/echo program

boediger's picture
Submitted by boediger (not verified) on Sat, 04/18/2009 - 06:59.

Why? The /bin/echo program is running as root, because of sudo, but the shell that's redirecting echo's output to the root-only file is still running as you. Your current shell does the redirection before sudo starts.

The solution is to run the whole pipeline under sudo. There are a couple ways to do it, but I prefer:

boediger

A whole article decribing a

Anonymous's picture
Submitted by Anonymous (not verified) on Sun, 04/12/2009 - 10:30.

A whole article decribing a single command line method? Surely more thought could have gone into this.

A whole article decribing a

K31th's picture
Submitted by K31th (not verified) on Mon, 04/06/2009 - 07:34.

A whole article decribing a single command line method? Surely more thought could have gone into this.

tee shirts?

felipe's picture
Submitted by felipe (not verified) on Sat, 04/04/2009 - 22:28.

man 1 tee
just as the above post explains, you can use tee. It is easier to visualise what's happening.

Proto's way is better.

jpenny's picture
Submitted by jpenny (not verified) on Fri, 04/03/2009 - 11:08.

Sorry, bad cut and paste. Proto's method shows:

Apr 3 12:00:09 xxxxxxxx sudo: xxxxxxx : TTY=pts/22 ; PWD=/tmp ; USER=root ; COMMAND=/bin/sh -c echo 0 >/proc/sys/net/ipv4/ip_forward

First set of xxxxxxxx is machine name, second is userid.

Proto's way is better

jpenny's picture
Submitted by jpenny (not verified) on Fri, 04/03/2009 - 11:13.

It gives better logging.

Using proto's method, auth.log shows:

Apr 3 12:00:12 xxxxxxxxx sudo: xxxxxxxx : TTY=pts/22 ; PWD=/tmp ; USER=root ; COMMAND=/usr/bin/tail /var/log/auth.log

Don's way just shows:

Apr 3 11:58:02 xxxxxxxx sudo: xxxxxxxx : TTY=pts/22 ; PWD=/tmp ; USER=root ; COMMAND=/bin/sh

sudo: cd: command not found

Anonymous's picture
Submitted by Anonymous (not verified) on Fri, 04/03/2009 - 10:04.

The one that drives me crazy is when I'm trying to change to a directory with only root access:

john@p490:~$ cd /root
john@p490:/root$ cd .gconf
bash: cd: .gconf: Permission denied
john@p490:/root$ sudo cd .gconf 
sudo: cd: command not found

I always just give up at that point and change to the root user account with:

$ sudo su -

but I guess I could stack up the commands as shown above.

I do the same with: sudo sh

Proto's picture
Submitted by Proto (not verified) on Wed, 04/01/2009 - 16:42.

I do the same with:

sudo sh -c "echo 12000 > /proc/sys/vm/dirty_writeback_centisecs"

I use the same one: sudo -c

Barun's picture
Submitted by Barun (not verified) on Tue, 05/05/2009 - 09:17.

I use the same one: sudo -c ''. It is the more direct approach available, than using echo with sudo.

how about 'sudo -i' first?

Gerald Marewo's picture
Submitted by Gerald Marewo (not verified) on Tue, 03/31/2009 - 01:55.

how about 'sudo -i' first?

I am totally agree with you,

day spa gold coast's picture
Submitted by day spa gold coast (not verified) on Tue, 04/07/2009 - 06:37.

I am totally agree with you, It's really great.

another way

Joe A's picture
Submitted by Joe A (not verified) on Mon, 03/30/2009 - 12:40.

I like to use tee for this. Using your example, you could use
$ echo 12000 | sudo tee /proc/sys/vm/dirty_writeback_centisecs

This works for the same reason, it runs tee with sudo. You can also use
tee -a
to append to file instead of overwriting it.

Webcast
More Resources
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers

Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.

Learn More

Sponsored by AMD

White Paper
More Resources
Red Hat White Paper: Using an Open Source Framework to Catch the Bad Guy

Built-in forensics, incident response, and security with Red Hat Enterprise Linux 6

Every security policy provides guidance and requirements for ensuring adequate protection of information and data, as well as high-level technical and administrative security requirements for a system in a given environment. Traditionally, providing security for a system focuses on the confidentiality of the information on it. However, protecting the data integrity and system and data availability is just as important. For example, when processing United States intelligence information, there are three attributes that require protection: confidentiality, integrity, and availability.

Learn more about catching the bad guy in this free white paper.

Learn More

Sponsored by DLT Solutions