How can I execute a group of commands as another user in Bash?

Question

There are already some existing questions asked here about running commands as another user. However, the question and answers focus on a single command instead of a long group of commands.

For example, consider the following script:

#!/bin/bash
set -e

root_command -p param1  # run as root

# these commands must be run as another user
command1 -p 'parameter with "quotes" inline'
command2 -p 'parameter with "quotes" inline'
command3 -p 'parameter with "quotes" inline'

There are a couple of important points to note here:

• The final three commands must be run as another user using su or sudo. In the example there were three commands, but suppose that there were many more...

• The commands themselves make use of single and double quotes.

The second point above prevents the use of the following syntax:

su somebody -c "command"

...since the commands themselves contain quotes.

What is the proper way to "group" the commands and run them under another user account?

Ungainly

Any luck on Unix stackexchange? – Schrock

See also now #37587311 – Vidda

Answer 1

Try this:

su somebody <<'EOF'
command1 -p 'parameter with "quotes" inline'
command2 -p 'parameter with "quotes" inline'
command3 -p 'parameter with "quotes" inline'
EOF

<< introduces a here-doc. The next token is the delimiter, and everything up to a line beginning with the delimiter is fed as standard input to the command. Putting the delimiter in single quotes prevents variable substitution within the here-doc.

Conscription

You, sir, are a genius. I had thought of using HEREDOC but couldn't find the correct syntax to make it work. Thanks! – Ungainly

Why is the -c flag not needed? Without -c, I get a permission denied error. – Taut

-c is used when the command is provided as an argument, rather than being read from standard input. – Conscription

If you encounter "su: must be run from a terminal", try sudo su somebody <<'EOF'. – Blinders

Is there a way to pass arguments into it? for example: su somebody <<'EOF' echo $1 command1 -p 'parameter with "quotes" inline' EOF doesn't work. :( – Brigitta

If you use <<EOF instead of <<'EOF' then variables inside the here-doc will be expanded. – Conscription

This will be useful to some: If you need the command to actually run in the user's full environment, as if they had logged in, which may include different paths, for example. Add they hyphen before 'somebody', like so: su - somebody ... – Millsap

Make sure there is no whitespace before closing EOF (eg when calling from indented 'if' statement). Error is thrown otherwise - see tldp.org/LDP/abs/html/here-docs.html – Novosibirsk

Please keep in mind that you can't use environment variables in HEREDOCs! I just stopped an rsync command that would have deleted all files on a server because ${GIT_PATH}/ was translated to / in the HEREDOC! – Ready

@PatrizioBekerle It works fine for me. Environment variables are treated as ordinary variables by the shell. – Conscription

@Barmar, strange. Did you define them inside or outside the heredoc? Mine where defined outside (in the same bash script)... – Ready

@PatrizioBekerle I did export test_var=foo then cat <<EOF <enter> foo $test_var <enter> EOF – Conscription

@PatrizioBekerle I did it interactively in the terminal, but I just tried it in a script as well, and they both worked. – Conscription

@Barmar, thank you for testing. I wonder what caused the variables not to be set for me. It would have been an elegant solution to use a heredoc. I fell back on doing a "su" on every command. – Ready

@PatrizioBekerle Perhaps you should write a new question and show exactly what you did. – Conscription

@Conscription right now it's enough for me to know that there might be a way if I want to use it next time. :) – Ready

Answer 2

I'm not that great with Bash-foo, so there is bound to be a more elegant way, but I've approached this problem in the past by using multiple scripts and a "driver".

E.g.,

Driver

#!/bin/bash
set -e

su root script1
su somebody script2

Script1

#!/bin/bash
set -e

root_command -p param1  # Run as root

Script2

#!/bin/bash
set -e

# These commands must be run as another user
command1 -p 'parameter with "quotes" inline'
command2 -p 'parameter with "quotes" inline'
command3 -p 'parameter with "quotes" inline'

Cutting

Answer 3

This script checks if the current user running the script is the desired user. If not, then the script is re-executed with the desired user.

#!/usr/bin/env bash

TOKEN_USER_X=TOKEN_USER_X
USER_X=peter # other user!

SCRIPT_PATH=$(readlink -f "$BASH_SOURCE")

if [[ "$@" != "$TOKEN_USER_X" ]]; then

    ###### RUN THIS PART AS the user who started the script

    echo "This script is $SCRIPT_PATH"

    echo -n "Current user: "
    echo $USER

    read -p "insert: "
    echo "got $REPLY"

    su - $USER_X -c "$SCRIPT_PATH $TOKEN_USER_X" # execute code below after else (marked #TOKEN_USER_X)

else
    #TOKEN_USER_X -- come here only if script received one parameter TOKEN_USER_X

    ###### RUN THIS PART AS USER peter

    echo
    echo "Now this script is $SCRIPT_PATH"

    echo -n "Current user: "
    echo $USER

    read -p "insert: "
    echo "got $REPLY"

    exit 0
fi

echo
echo "Back to initial user..."
echo -n "Current user: "
echo $USER

Aeolian