How To Run A Command As A Specific User In An Init Script On RHEL?

Published September 3, 2024

Problem: Running Commands as Specific Users in Init Scripts

Running commands as a specific user in an init script on Red Hat Enterprise Linux (RHEL) can be difficult. This task requires careful handling of permissions and system startup processes. Running commands with the right user privileges is important for security and system function.

Primary Solution: Using the 'daemon' Function

Sourcing the RHEL Init Functions

The /etc/rc.d/init.d/functions script is important in RHEL systems for managing init scripts. This script has functions that simplify common tasks in init scripts, including running commands as specific users. To use these functions in your init script, source the file at the start of your script:

#!/bin/bash
. /etc/rc.d/init.d/functions

This line gives you access to all the functions in the RHEL init script library.

Tip: Check Function Availability

Before using any function from the RHEL init library, it's a good practice to check if it's available. You can do this by using the 'type' command:

if type -t daemon &>/dev/null; then
    echo "The daemon function is available"
else
    echo "The daemon function is not available"
fi

This helps ensure your script remains portable across different RHEL versions or distributions.

Implementing the 'daemon' Function

The 'daemon' function is a tool provided by the RHEL init functions. It lets you start processes as different users and manages various aspects of daemon management. The basic syntax for using the daemon function to run a command as a specific user is:

daemon --user=username command

For example, to run a script called "myservice.sh" as the user "appuser", you would use:

daemon --user=appuser /path/to/myservice.sh

This method works well for starting long-running processes or services. The 'daemon' function sets up the proper environment and handles output redirection, making it a good choice for init scripts on RHEL systems.

Alternative Solution: Using 'runuser'

Introduction to 'runuser'

The 'runuser' command is a tool for running commands as a different user in Linux systems. It's useful in init scripts on RHEL systems. Unlike 'sudo', 'runuser' doesn't need password authentication, making it better for automated scripts and system startup processes.

'runuser' offers these benefits:

It lets you run commands with the privileges of a specific user without authentication.
It gives more control over the execution environment, including setting the shell and environment variables.
It's made for system tasks and is simpler than 'sudo' for some operations.

Compared to 'sudo', 'runuser' focuses more on system-level tasks and doesn't need user-specific permissions in the sudoers file.

Tip: Use 'runuser' for Specific Environment Variables

When you need to run a command with specific environment variables, 'runuser' is particularly useful. You can set environment variables within the command string:

/sbin/runuser username -s /bin/bash -c "export CUSTOM_VAR=value; your_command"

This allows you to create a customized environment for the command execution.

Implementing 'runuser' in Init Scripts

To use 'runuser' in your init scripts, use this basic syntax:

/sbin/runuser username -s /bin/bash -c "command"

Here's an example of how to use 'runuser' to run a command as another user in an init script:

/sbin/runuser myapp_user -s /bin/bash -c "/path/to/myapp start"

In this example, 'myapp_user' is the username you want to run the command as, and '/path/to/myapp start' is the command you want to run.

Key points when using 'runuser' in init scripts:

Always use the full path to the 'runuser' command (/sbin/runuser) to avoid path-related issues.
Put the command in quotes, especially if it has spaces or special characters.
Use the '-s' option to set the shell if needed.
For multiple commands, separate them with semicolons within the quotes.

	English
	Deutsch
	Français