# Executing sudo from ruby **URL:** \ **Category:** Ruby\ **Created:** [June 13, 2007, 1:20pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700 "2007-06-13T13:20:48Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 1:20pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/1 "2007-06-13T13:20:48Z")
hi, I wanna execute in a script of mine commands like: “sudo apt-get clean” or “sudo nano /etc/X11/xorg.conf”. The difference is: The first command needs to be executed without influence to the main process of the ruby scipt. It should simply be started as a second process totally independent from the ruby-script which invokes it. I think system(“sudo apt-get clean”) would be the right command. The second command should be this way that it is the only one after it has been executed. So the ruby-script should be stopped and therefor in the same console nano should be opened. I think exec(“sudo nano /etc/X11/xorg.conf”) would be the right command. But my problem is the password of sudo? How can I make my ruby-scipt give the password to sudo so I don’t have to give it in every time? – greets ``` one must still have chaos in oneself to be able to ``` give birth to a dancing star ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 1:52pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/2 "2007-06-13T13:52:52Z")
Hardcoding passwords is a very, very, very, very bad idea. If you really need to do this - and it’s very likely that there’s a better, safer way to do it, but there’s not enough information given on what you’re actually trying to achieve - read up on sudo and how you can use its configuration files to grant users or groups the ability to run particular, selected commands via sudo without requiring a password. “man sudoers” should be a pretty good start. ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 2:05pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/3 "2007-06-13T14:05:54Z")
anansi wrote: > has been executed. So the ruby-script should be stopped and therefor in > the same console nano should be opened. > I think exec(“sudo nano /etc/X11/xorg.conf”) would be the right command. > > But my problem is the password of sudo? How can I make my ruby-scipt > give the password to sudo so I don’t have to give it in every time? Set NOPASSWD in your sudoers file for the given commands, eg.: sudoeruser ALL=(ALL) NOPASSWD: /usr/bin/nano,/usr/bin/apt-get Morten ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 2:10pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/4 "2007-06-13T14:10:55Z")
thanks for your answers but that are no options here. I know hardcoded passes are in generally a bad idea but it’s really needed here and safe. This is just a personal code on an offline pc with a highly encrypted partitions… Is there no way to give the pass as argument or pipe it or kind if that? But as said I need a technique working in both cases mentioned in the first post. Morten wrote: > > The second command should be this way that it is the only one after it > > sudoeruser ALL=(ALL) NOPASSWD: /usr/bin/nano,/usr/bin/apt-get > > Morten – greets ``` one must still have chaos in oneself to be able to ``` give birth to a dancing star ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 2:13pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/5 "2007-06-13T14:13:55Z")
On 6/13/07, anansi [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > The second command should be this way that it is the only one after it > has been executed. So the ruby-script should be stopped and therefor in > the same console nano should be opened. > I think exec(“sudo nano /etc/X11/xorg.conf”) would be the right command. > > But my problem is the password of sudo? How can I make my ruby-scipt > give the password to sudo so I don’t have to give it in every time? I am not so clear on what you are asking here, but you can perhaps give a password to sudo via stdin. Here’s a line from “man sudo”: -S The -S (stdin) option causes sudo to read the password from the standard input instead of the terminal device. To open a pipe to a subprocess, see IO.popen, example near the bottom of this page: [http://www.rubycentral.com/book/tut\_threads.html](http://www.rubycentral.com/book/tut_threads.html) I can’t comment on the safety of doing this, but it’s surely not the worst way to send a password. Les – ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 2:41pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/6 "2007-06-13T14:41:02Z")
the thing is that everything needs to be done by this script and no further command. So can an app give it self the root uid at runtime? Alex Y. wrote: > > The second command should be this way that it is the only one after it – greets ``` one must still have chaos in oneself to be able to ``` give birth to a dancing star ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 2:27pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/7 "2007-06-13T14:27:00Z")
anansi wrote: > has been executed. So the ruby-script should be stopped and therefor in > the same console nano should be opened. > I think exec(“sudo nano /etc/X11/xorg.conf”) would be the right command. > > But my problem is the password of sudo? How can I make my ruby-scipt > give the password to sudo so I don’t have to give it in every time? Wouldn’t a setuid root script that actually calls the executable you’re aiming at do what you need here? ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 3:20pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/8 "2007-06-13T15:20:07Z")
anansi wrote: > the thing is that everything needs to be done by this script and no > further command. So can an app give it self the root uid at runtime? > After a little experimentation (on Ubuntu), it would seem that the only > way to get my suggestion to work is by creating a setuid link to the > ruby binary, and using that to run the script. That’s just as insecure > as keeping a password in a file, so I take back my suggestion entirely. A slightly less unsafe method (but still rather iffy) would be to create a public key for the root account, and do everything over SSH. That way you can arrange to only need to authenticate once per session (or, if you really want to play fast and loose, leave the private key with an empty passphrase). I don’t know if that helps at all… – Alex ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 4:14pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/9 "2007-06-13T16:14:18Z")
On 13-Jun-07, at 8:40 AM, anansi wrote: > the thing is that everything needs to be done by this script and no > further command. So can an app give it self the root uid at runtime? If you aren’t worried about security, you might try expect. Using expect you can define responses to prompts, e.g. responding with the password. * * * Bob H. – tumblelog at \ Recursive Design Inc. – weblog at \<[http://www.recursive.ca/](http://www.recursive.ca/) hutch\> – works at [http://www.recursive.ca/](http://www.recursive.ca/) ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 6:36pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/10 "2007-06-13T18:36:45Z")
thanks for the hint but I only found this about expect:[http://www.ruby-doc.org/stdlib/libdoc/pty/rdoc/classes/IO.html#M001710](http://www.ruby-doc.org/stdlib/libdoc/pty/rdoc/classes/IO.html#M001710) . Is there any better doc or examples for this ? – greets ``` one must still have chaos in oneself to be able to ``` give birth to a dancing star ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 4:41pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/11 "2007-06-13T16:41:24Z")
On Wed, 13 Jun 2007 22:19:16 +0900, Alex Y. wrote: > you can arrange to only need to authenticate once per session (or, if > you really want to play fast and loose, leave the private key with an > empty passphrase). I don’t know if that helps at all… To run your editor, you’d probably need to use the -t option of ssh to alloate a pseudo-tty. You can configure the SSH keypair so that it’s only authorized to run a couple of specific commands, which should help with security. Also, be sure to use “nano -R” so that the user can’t edit other files. The exec() call is wrong, because that replaces the running ruby script with a different process, and the ruby script can’t terminate. system() is correct for the second case too. ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 8:26pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/12 "2007-06-13T20:26:06Z")
On 13-Jun-07, at 12:35 PM, anansi wrote: > thanks for the hint but I only found this about expect:http:// > [www.ruby-doc.org/stdlib/libdoc/pty/rdoc/classes/IO.html#M001710](http://www.ruby-doc.org/stdlib/libdoc/pty/rdoc/classes/IO.html#M001710) > . Is there any better doc or examples for this ? I used the unix version of the command directly. The man page is useful I thought. I’ve never used the ruby expect classes but imagine that they would be doing something similar. Cheers, Bob > – > greets > > ``` > one must still have chaos in oneself to be able > > ``` > > to give birth to a dancing star * * * Bob H. – tumblelog at \ Recursive Design Inc. – weblog at \<[http://www.recursive.ca/](http://www.recursive.ca/) hutch\> – works at [http://www.recursive.ca/](http://www.recursive.ca/) ---
**Author:** ![anansi](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/9fc348/32.png) [@anansi](https://www.ruby-forum.com/u/anansi)\ **Post date:** [June 13, 2007, 9:44pm UTC](https://www.ruby-forum.com/t/executing-sudo-from-ruby/106700/13 "2007-06-13T21:44:48Z")
Alex Y. wrote: > anansi wrote: > > > the thing is that everything needs to be done by this script and no > > further command. So can an app give it self the root uid at runtime? > > After a little experimentation (on Ubuntu), it would seem that the only > > way to get my suggestion to work is by creating a setuid link to the > > ruby binary, and using that to run the script. That’s just as insecure > > as keeping a password in a file, so I take back my suggestion entirely. > > A slightly less unsafe method (but still rather iffy) would be to create > a public key for the root account, and do everything over SSH. That way > you can arrange to only need to authenticate once per session (or, if > you really want to play fast and loose, leave the private key with an > empty passphrase). I don’t know if that helps at all… > > – > Alex How about running job in a cron under root user. sudo kcron (in kde) will start kcron in mode where you can schedule a job to run as any user. by TheR