Bsrgvty

What is the fastest algorithm for finding the natural logarithm of a big number?

"Dear Stack Exchange, I am very disappointed in you" - How to construct a strong opening line in a letter?

Can the Bountiful Luck halfling racial feat be used multiple times in one round?

"Shake your head all you like" meaning

Did smallpox emerge in 1580?

How to handle shared mortgage payment if one person can't pay their share?

Island of Knights, Knaves, Spies

An idiomatic word for "very little" in this context?

Java creating augmented array of size 400,000,000

Why is it popular to teach modulus via the example of mod 12 and analogue clocks?

Can the bass be used instead of drums?

What is the German word for: "It only works when I try to show you how it does not work"?

SSD or HDD for server

How did Ron get five hundred Chocolate Frog cards?

Having trouble with accidentals - Note-for-note vs traditional?

What's the most efficient way to draw this region?

How honest to be with US immigration about uncertainty about travel plans?

Can migraine attacks be predicted by any means?

Big Bracket for equations

Raspberry pi run commands on boot

Proofreading a novel: is it okay to use a question mark with an exclamation mark - "?!"

33 Months on Death Row

Is It Possible to Make a Computer Virus That Acts as an Anti-virus?

Are There 3D Rules for Flying and Distance?

Sudo command gets executed as root instead of specified user

Tracking what commands were executed after sudo to another userDetails about sudo commands executed by all userWhy does the root user need sudo permission?How to prevent the caller's shell from being used in sudoRun sudo command with non-root user in Docker containerRestrict user to run specific sudo commandhow to let sudo fork bash instead of sh?Set custom environment to root user from normal user (sudo -i)How a non-root user sudo to another non-root user without password?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;

6

sudo -EH -u someuser nohup sh check.sh &

Above commands runs the process as root instead of the user specified by -u flag.

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh &

Below are the sudoers entry.

Cmnd_Alias SUDO_CMNDS = /bin/echo,/bin/ls,/bin/cat,/bin/vim,/bin/mv,/bin/cp,/bin/rm,/bin/mkdir,/bin/diff,/bin/id,/bin/hostname,/bin/grep,/bin/nohup,/bin/locate,/bin/find,/bin/sed,/bin/awk,/usr/bin/whoami

%sudomygroup ALL=(someuser) NOPASSWD:SETENV: SUDO_CMNDS

Extra output as suggested by @michael homer

$ ps -ef|grep -i check 
root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

linux bash sudo

share|improve this question

edited Apr 29 at 7:56

Michael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

asked Apr 29 at 7:38

AVSAVS

11311 gold badge11 silver badge99 bronze badges

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Your second quote looks like it's reporting who ran sudo, not nohup.
  
  – Michael Homer
  Apr 29 at 7:40
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Also, is the & really included in the output?
  
  – Michael Homer
  Apr 29 at 7:41
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  yes & is in the output .So how can i check who executed nohup
  
  – AVS
  Apr 29 at 7:44
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How did you check the one you quoted? See if there's anything more there.
  
  – Michael Homer
  Apr 29 at 7:45
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I checked it using "ps -ef|grep -i nohup"
  
  – AVS
  Apr 29 at 7:46
  

  
  
  
  

 | 
show 3 more comments

6

sudo -EH -u someuser nohup sh check.sh &

Above commands runs the process as root instead of the user specified by -u flag.

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh &

Below are the sudoers entry.

Cmnd_Alias SUDO_CMNDS = /bin/echo,/bin/ls,/bin/cat,/bin/vim,/bin/mv,/bin/cp,/bin/rm,/bin/mkdir,/bin/diff,/bin/id,/bin/hostname,/bin/grep,/bin/nohup,/bin/locate,/bin/find,/bin/sed,/bin/awk,/usr/bin/whoami

%sudomygroup ALL=(someuser) NOPASSWD:SETENV: SUDO_CMNDS

Extra output as suggested by @michael homer

$ ps -ef|grep -i check 
root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

linux bash sudo

share|improve this question

edited Apr 29 at 7:56

Michael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

asked Apr 29 at 7:38

AVSAVS

11311 gold badge11 silver badge99 bronze badges

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  Your second quote looks like it's reporting who ran sudo, not nohup.
  
  – Michael Homer
  Apr 29 at 7:40
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Also, is the & really included in the output?
  
  – Michael Homer
  Apr 29 at 7:41
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  yes & is in the output .So how can i check who executed nohup
  
  – AVS
  Apr 29 at 7:44
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How did you check the one you quoted? See if there's anything more there.
  
  – Michael Homer
  Apr 29 at 7:45
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I checked it using "ps -ef|grep -i nohup"
  
  – AVS
  Apr 29 at 7:46
  

  
  
  
  

 | 
show 3 more comments

sudo -EH -u someuser nohup sh check.sh &

Above commands runs the process as root instead of the user specified by -u flag.

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh &

Below are the sudoers entry.

Cmnd_Alias SUDO_CMNDS = /bin/echo,/bin/ls,/bin/cat,/bin/vim,/bin/mv,/bin/cp,/bin/rm,/bin/mkdir,/bin/diff,/bin/id,/bin/hostname,/bin/grep,/bin/nohup,/bin/locate,/bin/find,/bin/sed,/bin/awk,/usr/bin/whoami

%sudomygroup ALL=(someuser) NOPASSWD:SETENV: SUDO_CMNDS

Extra output as suggested by @michael homer

$ ps -ef|grep -i check 
root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

linux bash sudo

share|improve this question

edited Apr 29 at 7:56

Michael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

asked Apr 29 at 7:38

AVSAVS

11311 gold badge11 silver badge99 bronze badges

sudo -EH -u someuser nohup sh check.sh &

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh &

Cmnd_Alias SUDO_CMNDS = /bin/echo,/bin/ls,/bin/cat,/bin/vim,/bin/mv,/bin/cp,/bin/rm,/bin/mkdir,/bin/diff,/bin/id,/bin/hostname,/bin/grep,/bin/nohup,/bin/locate,/bin/find,/bin/sed,/bin/awk,/usr/bin/whoami

$ ps -ef|grep -i check 
root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

share|improve this question

edited Apr 29 at 7:56

Michael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

asked Apr 29 at 7:38

AVSAVS

11311 gold badge11 silver badge99 bronze badges

share|improve this question

edited Apr 29 at 7:56

Michael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

asked Apr 29 at 7:38

AVSAVS

11311 gold badge11 silver badge99 bronze badges

edited Apr 29 at 7:56

Michael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

edited Apr 29 at 7:56

Michael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

asked Apr 29 at 7:38

AVSAVS

11311 gold badge11 silver badge99 bronze badges

asked Apr 29 at 7:38

AVSAVS

11311 gold badge11 silver badge99 bronze badges

1 Answer
1

active

oldest

votes

16

This line:

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh

is reporting that sudo ... was run as the root user. That happens because the sudo binary is setuid, and it's expected (regardless of which user asked sudo to run). What you're trying to find out is what user the command that sudo then ran is executing as.

Using ps -ef|grep -i nohup gave you only that single line of output, because when nohup runs it immediately shuts itself off upon executing the command it was asked to run, and then there's no nohup left in the ps output to grep for afterwards.

If you instead search for check.sh, you'll get (at least) two lines of output: the one you already see, and another one that's just for sh /tmp/check.sh:

root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

That shows that the sh command is running as someuser, while sudo is just sitting there waiting for the inner command to finish, still running as root itself.

share|improve this answer

edited Apr 29 at 7:56

answered Apr 29 at 7:54

Michael HomerMichael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  Yes, it does. The "inner" command sh is running as someuser, and the "outer" command sudo is sitting around as root waiting for the inner to finish.
  
  – Michael Homer
  Apr 29 at 7:57
  

  
  
  
  

add a comment
 | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f516113%2fsudo-command-gets-executed-as-root-instead-of-specified-user%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

16

This line:

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh

is reporting that sudo ... was run as the root user. That happens because the sudo binary is setuid, and it's expected (regardless of which user asked sudo to run). What you're trying to find out is what user the command that sudo then ran is executing as.

Using ps -ef|grep -i nohup gave you only that single line of output, because when nohup runs it immediately shuts itself off upon executing the command it was asked to run, and then there's no nohup left in the ps output to grep for afterwards.

If you instead search for check.sh, you'll get (at least) two lines of output: the one you already see, and another one that's just for sh /tmp/check.sh:

root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

That shows that the sh command is running as someuser, while sudo is just sitting there waiting for the inner command to finish, still running as root itself.

share|improve this answer

edited Apr 29 at 7:56

answered Apr 29 at 7:54

Michael HomerMichael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  Yes, it does. The "inner" command sh is running as someuser, and the "outer" command sudo is sitting around as root waiting for the inner to finish.
  
  – Michael Homer
  Apr 29 at 7:57
  

  
  
  
  

add a comment
 | 

16

This line:

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh

is reporting that sudo ... was run as the root user. That happens because the sudo binary is setuid, and it's expected (regardless of which user asked sudo to run). What you're trying to find out is what user the command that sudo then ran is executing as.

Using ps -ef|grep -i nohup gave you only that single line of output, because when nohup runs it immediately shuts itself off upon executing the command it was asked to run, and then there's no nohup left in the ps output to grep for afterwards.

If you instead search for check.sh, you'll get (at least) two lines of output: the one you already see, and another one that's just for sh /tmp/check.sh:

root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

That shows that the sh command is running as someuser, while sudo is just sitting there waiting for the inner command to finish, still running as root itself.

share|improve this answer

edited Apr 29 at 7:56

answered Apr 29 at 7:54

Michael HomerMichael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

• 
  
  
  

  
  3
  

  
  
  
  
  
  

  
  
  Yes, it does. The "inner" command sh is running as someuser, and the "outer" command sudo is sitting around as root waiting for the inner to finish.
  
  – Michael Homer
  Apr 29 at 7:57
  

  
  
  
  

add a comment
 | 

This line:

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh

is reporting that sudo ... was run as the root user. That happens because the sudo binary is setuid, and it's expected (regardless of which user asked sudo to run). What you're trying to find out is what user the command that sudo then ran is executing as.

Using ps -ef|grep -i nohup gave you only that single line of output, because when nohup runs it immediately shuts itself off upon executing the command it was asked to run, and then there's no nohup left in the ps output to grep for afterwards.

If you instead search for check.sh, you'll get (at least) two lines of output: the one you already see, and another one that's just for sh /tmp/check.sh:

root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

That shows that the sh command is running as someuser, while sudo is just sitting there waiting for the inner command to finish, still running as root itself.

share|improve this answer

edited Apr 29 at 7:56

answered Apr 29 at 7:54

Michael HomerMichael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

root 4056 2388 0 13:00 pts/4 00:00:00 sudo -EH -u someuser nohup sh /tmp/check.sh

root 14260 14090 0 13:20 pts/4 00:00:00 sudo -HE -u someuser nohup sh /tmp/check.sh
someuser 14261 14260 0 13:20 pts/4 00:00:00 sh /tmp/check.sh

share|improve this answer

edited Apr 29 at 7:56

answered Apr 29 at 7:54

Michael HomerMichael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

answered Apr 29 at 7:54

Michael HomerMichael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges

answered Apr 29 at 7:54

Michael HomerMichael Homer

55.6k99 gold badges156156 silver badges191191 bronze badges