su without password within a script

Question

I'm sure this question has been answered before, but I can't find an answer that I like. I would like to write a shell script that executes a very specific script as another user (I want anyone to be able to start postgres as the postgres user). The script will have 710 perms so it will be executable by a certain group but not readable or writable by that group.

Now, I'm pretty sure there's no way to use 'su' without an interactive password prompt. There are lots of good reasons for that and I don't need to be convinced of the merit of those reasons (I'm told that someone savvier than me could grab the password off the processes list which is bad).

Question is, more generally how would I accomplish what I want to do without abusing unix security paradigms? Is there a way to allow user to execute a very specific process as another user?

Answer 1

This sort of situation is exactly what sudo was designed for.

Answer 2

You can create an executable (not a shell script) that launches the script that should run as the postgres user. Change the owner of the executable to the postgres user, and set the setuid bit.

See Best practice to run Linux service as a different user to address Celada's concern.

Answer 3

Well, you could use a simple script to access programmatically to an user using sudo and then execute all code you want.

Here is a simple script:

if [ "$#" -ne 2 ]; then
    echo "Usage: "
    echo "  suprompt <user> <password>"
else
    echo $2 | sudo -sS su $1 
    sudo su $1
fi

This script uses two arguments. The first one is the user you want to be, and the second arg is the password.

It works automatically.

You can change the final statement and do: sudo su $1 -c <command>

I hope this will work for you.