Hacker News Reader

Comment by nerdponx | Hacker News Reader

Would

    sudo (cat foobar.img > /dev/sdi)

Work?

View on HN

No, you should use

  sudo sh -c "cat foobar.img > /dev/sdi"

  sudo -s "cat foobar.img > /dev/sdi"

I was originally going to put that in my examples, but opted to leave it out, because with sh -c you have to think about escaping special characters. Most of the time it doesn't matter, but when running commands as root you ought to be absolutely sure.

What about using a here-doc (as in http://stackoverflow.com/a/16514624/2954547)?

    sudo sh <<EOF
    cat foobar.img > /dev/sdi
    EOF

No, unless you have a shell where sudo is a built-in, and I don't know of any.

This is actually impossible (at least with UNIX shells), as shell builtins cannot have the SUID bit set - and your shellitself also shouldn't ;)

You could have a shell with a "sudo" builtin that knew how to invoke a separate "sudo" program with the right shell syntax and quoting, such that "sudo somecommand > /path/to/root-writable-file" did the right thing.

Not really - to sudo, your shell would have to be setuid - and constantly fork stuff as you to get user permissions. Alternatively your shell could maintain a separate process for privileged access, but that puts a whole lot of your security on the assumption that your shell has no bugs that might allow escalation.

In short, you could do it, but it'd be ripped out of every server that's been hardened, and for users that don't want to care - they're just running 'sudo su' anyhow.

Speaking only for myself, the thought of my shell having a magical escalation process would scare the bejeezus out of me - and I'm supposed to have root on our boxes!

The shell wouldn't need to be setuid if it just performed a syntax transformation and then called the existing sudo binary.

Exactly. The shell would just treat "sudo" as a builtin prefix similar to "time", but would then run the real "sudo" with an appropriate shell invocation and proper quoting.

I finally got home to try it, and indeed it does fail (Zsh).

    zsh: parse error near `)'

Is it just ignoring the parentheses? Does the redirection "take precedence" over parentheses and brackets?

Reply on news.ycombinator.com