Sudo redirected stdout file ownership

Question

I am redirecting stdout from a sudo. However, the file ownership of the output file is the user who ran sudo, not the sudo target user.

I'm logged in as 'root' for the command below:

sudo -u w3svcsadm echo "TEST ran" > /home/youribm/emaildigest/TEST_$( date +%Y%m%d%H%M%S ).output  

The output file is being created with the owner of 'root', but I want 'w3svcsadm' to be the owner (this is causing permissions problems for us). I have tried all manner of parens in the command, but I cannot get it to give the target user ownership.

Answer 1

I'm logged in as 'root' for the command below

It's a little strange to:

1. be using the root account for running user tasks
2. to use sudo to drop privileges from root (when you could just use 'su')

The reason for your problem is that you are redirecting the output of the sudo command when really you want to redirect the output of w3svcsadm:

sudo sudo -u w3svcsadm \
 'echo "TEST ran" > /home/youribm/emaildigest/TEST_$( date +%Y%m%d%H%M%S ).output'  

Answer 2

The answer you need is to run your command as follows (or in a similar way):

sudo -u w3svcsadm bash -c 'echo "TEST ran" > /home/youribm/emaildigest/TEST_$( date +%Y%m%d%H%M%S ).output'

The difference is:

• in your version, the sudo means that echo "TEST ran" is being run as w3svcsadm. The > /home/youribm/emaildigest/TEST_$( date +%Y%m%d%H%M%S ).output is being run as your current user, which is apparently root.

• what you actually want is for the whole block, including redirection, to be run as w3svcsadm. In my suggestion, I achieve that by running bash as w3svcsadm, and telling bash to run the full command-line (echo "TEST ran" > /home/youribm/emaildigest/TEST_$( date +%Y%m%d%H%M%S ).output), and then exit.

Or, in simpler terms: redirection is a form of piping between two commands, and in your case, you want both commands to be run by the same user.

It may help to mentally replace > with ; (or &&) to understand: command one is echo, and command two is write standard input into this file.

The first 'half' of the command (before redirection) is being run by sudo, and the rest is not. Although we generally consider a command with output redirection as one command, it isn't - it is two commands, and so you need to ensure both commands are being run by the user you intended.

Answer 3

this use sudo only for part before redirection, use

sudo -u w3svcsadm -c 'echo "TEST ran" > /home/youribm/emaildigest/TEST_$( date +%Y%m%d%H%M%S ).output'

or you can use

echo "TEST ran" | sudo -u w3svcsadm tee /home/youribm/emaildigest/TEST_$( date +%Y%m%d%H%M%S ).output

Answer 4

Thanks, everyone!

@Quantum, unfortunately our version of 'sudo' does not have the '-c' option.

@iwaseatenbyagrue Thanks for the in-depth explanation. I knew it had to be something like that, but never thought of running bash with a command.

@symcbean The "downgrading" of permissions was just a test case. The real problem I'm having is in a cron job, and this is causing issues when it creates the file as root.