How to do this?

I would like to run a script with root rights from an application. The password should be transferred automatically.

Rainer Stratmann wrote

How to do this? I would like to run a script with root rights from an application. The password should be transferred automatically.

Assuming you're talking unix: probably setuid root, but note that some programs- particularly anything using gtk- don't like this.

Otherwise you're probably into the realms of SSHing to localhost, but if you're having to do that sort of thing you really do need to ask yourself whether you really want to do what you think you want to do.

Rainer Stratmann wrote

How to do this? I would like to run a script with root rights from an application. The password should be transferred automatically.

As far as I know, this cannot be done except by making the application itself setuid root. If you create a setuid script, it will nevertheless execute with the rights of the invoking user.

I use a very small program which is setuid root, which I supply with the name of a script and the arguments to feed to the script. The name of the script must match one of a list.

Michael.

Rainer Stratmann wrote

How to do this? I would like to run a script with root rights from an application. The password should be transferred automatically.

Others told that unix doesn't allow skripts run as root.

For your task sudo may help. With it you allow the user (or group) in question to run programs with root rights, but they have to identify with their own password. Lowering security risk ...

That seens to be true. Nothing found about that.

What works is an entry in the sudoers file.
And then the program/script you can call with root rights.

For your task sudo may help. With it you allow the user (or group) in question to run programs with root rights, but they have to identify with their own password. Lowering security risk ...

What do you mean exactly with "with their own password"?

Am 07.12.2015 00:52 schrieb "Rainer Stratmann" <

When one calls sudo one uses the password of one's own account to elevate the rights and not the root password, at least as long one is in a group that allows that in the sudoers file (usually that group is "wheel").

Regards,
Sven

Rainer Stratmann wrote

What works is an entry in the sudoers file. And then the program/script you can call with root rights.

I hope this is for something that will only ever run on your own machine, because unless you take a lot of precautions (hardcoding a set of *absolute* paths to scripts that may be executed this way like Michael mentioned can help, but only if you can guarantee none of these locations can be overwritten, symlinked to somewhere else or substituted through mounting), this is a security disaster waiting to happen.

A lot of security holes in various Unix-like OSes happen through abuse of setuid helpers or helper programs executed as root. If you really need to do something as root, having a small setuid binary that can only do this one thing is much safer than invoking a general purpose shell that can do anything. You can find a very basic overview of some issues at
https://developer.apple.com/library/mac/documentation/OpenSource/Conceptual/ShellScripting/ShellScriptSecurity/ShellScriptSecurity.html .

If everything mentioned there isn't completely obvious to you, please do not distribute any program that invokes shell scripts as root before you familiarise yourself very thoroughly with security at the Unix/shell level. And even if it is, ask yourself whether there is no safer way to achieve the same results.

Jonas

I am aware of some security stuff. And I asked myself often to do more security. For example disabling ssh on the machine. And some more.

But in some cases I need root acess. The location is secret and is deleted after the call. That's all I can do so far.

Only this application runs on the machine.

With 'setuid binary' I am not familiar.