Grant normal user to run certain script with root access

cdestiny · 09-30-2008, 01:08 AM

Hi,

Recently i have complain from user that the vnc session failed to create as the lock in /tmp/. The lock created eg: .X0-lock , .X1-lock . Only root can remove the lock.

So i have written a simple script for the user to trigger and remove the lock files.

Code:

#!/bin/sh

cd /tmp
ls -al | grep "\-lock" | awk '{print $9}' > /tmp/flist.txt
for i in `cat /tmp/flist.txt`
do
        cd /tmp
        rm -rf $i
done


echo "Finish flushing"

It running with root account.

So i visudo and add in the row

Code:

john ALL=NOPASSWD: /usr2/flush.sh

Then i su as john and run the flush script. These are the error message produced:

rm: cannot remove `.X0-lock': Operation not permitted
rm: cannot remove `.X1-lock': Operation not permitted

Please advice and let me know if i did something wrong. Thanks in advance.

Mr. C. · 09-30-2008, 01:23 AM

Your script is dangerous, and will happily remove any files containing the letters "lock", such as "block", "clock", "someother.lock", and even ".X0-lock" as you've discovered. If you want to remove files named .lock*, simplify your entire script to the single command:

rm -f /tmp/.lock*

cdestiny · 09-30-2008, 01:51 AM

Quote:

Originally Posted by Mr. C.

Your script is dangerous, and will happily remove any files containing the letters "lock", such as "block", "clock", "someother.lock", and even ".X0-lock" as you've discovered. If you want to remove files named .lock*, simplify your entire script to the single command:

rm -f /tmp/.lock*

Thanks for the reply.

I have edited my script on above.
The lock generated is usually X1-lock , not a .lock.

Mr. C. · 09-30-2008, 01:54 AM

I see. Your first post indicated "/tmp/.lock", so there's the disconnect.

Everything OK now?

cdestiny · 09-30-2008, 02:42 AM

Quote:

Originally Posted by Mr. C.

I see. Your first post indicated "/tmp/.lock", so there's the disconnect.

Everything OK now?

Ah... i missed 1 important step. include sudo infront of the command......
It is now working. Thanks for your help.