How can I use sudo within a function?

Question

I have written a function which acts in a similar way to tee but also pre-pends a datestamp. everything works fine except when i want to output to a file which is only root writable (in my case a logfile within /var/log). I've simplified the following code snippet to just include the bits which are not working:

#!/bin/bash
#script ~/test_logger.sh
logfile=/var/log/test.log
logger()
{
    while read data
    do
        echo $data >> $logfile
    done
    return 0
}
sudo ls ~ | logger

it works fine if i run the whole script like so sudo ~/test_logger.sh but i can't always do this since i want to use the logger function in files like ~/.bash_logout which are run automatically. i've tried putting sudo in front of the echo in the while loop but this does not work. any ideas?

Answer 1

it's generally bad practice to put sudo in a script. A better choice would be to call the script with sudo from ~/.bash_logout or wherever else you want to use it, if you must, or better still just make /var/log/test.log world-writable.

Answer 2

as you've found, sudo command >out doesn't work because 'command' is run by sudo, but '>out' is a function of the shell, not 'command'. So, you need to escalate the shell itself:

sudo sh -c "echo $data >>$logfile"

note that you want to be really, really sure what's in $data doing this:

~$ export data='good; touch /tmp/reallybad'
~$ echo $data
good; touch /tmp/reallybad
~$ sudo sh -c "echo $data>>/tmp/happy"
good
~$ ls /tmp/happy /tmp/reallybad
/tmp/happy  /tmp/reallybad

hence simon's warning.

Answer 3

sudo does not work in the way you might think when you use redirection or pipe operators. The stream change is not executed with sudo permissions. This is why

sudo echo foo >> bar

will not work if bar is only root-writable.

When you run the script under sudo, everything in the script gets superuser permissions so it works correctly in that circumstance.

A workaround is to do this to make sure the writing command is run under sudo:

sudo echo foo | sudo tee bar > /dev/null

Bear in mind, however, that this does not append to the file. It overwrites the file.

Answer 4

You are sudoing just the ls command, but not logger. Bash doesn't (and shouldn't) know what sudo does, so it just pipes two commands. The first one is sudo and the second one is logger. No matter if you sudo ls, logger won't.

You should sudo logger, but it won't work because it is a Bash function instead of an executable to be executed by sudo.

BEWARE: ls | sudo logger will invoke /usr/bin/logger if it is installed in your system. Remember: sudo doesn't know about Bash functions.

I'd suggest you adding the user invoking your script to the file owner's group so you're able to write to it without special privilege escalation.

Plus, efficiency sake, you are opening and closing the log file for every line read. You can do it only once for the entire logging process:

function logger() {
  while read data
  do
    echo "$data"
  done
  return 0
} >>"$logfile"

Answer 5

Well if you take a look at the man page of sudo you can see examples of how to use it in the scripts... the -c option lets execute a command.