Run some commands as one user, and access variables set by another user

Question

What I'm aiming for:

I want to run:

1. multiple lines at once
2. under another user
3. with access to the variables set by the user I'm running from

So from this:

ROOT_VAR='var-set-from-root'

cmd="
 echo $ROOT_VAR
 echo `whoami`
 echo $HOME
"

the DESIRED RESULT would be:

var-set-from-root
UserA
/home/UserA

What I've tried so far:

1 run with bash; commands contained in double quotes:

cmd="
 echo $ROOT_VAR
 echo `whoami`
 echo $HOME
"

sudo -u UserA bash -c "{$cmd}"

# result (has access to root var but still running as root):
var-set-from-root
root
/root

2 run with bash with commands in heredoc

sudo -u UserA bash -c<<EOF
 echo $ROOT_VAR
 echo `whoami`
 echo $HOME
EOF

# result (error):
bash: -c: option requires an argument

3 run with su and commands in heredoc with single quote

su UserA <<'EOF'
 echo $ROOT_VAR
 echo `whoami`
 echo $HOME
EOF

# result (no access to root var but running as correct user):

UserA
/home/UserA

4 run with su and commands in heredoc without quotes

su UserA <<EOF
 echo $ROOT_VAR
 echo `whoami`
 echo $HOME
EOF

# result (has access to root var but still running as root):
var-set-from-root
root
/root

5 run with bash; commands in double quotes; root var passed as param:

cmd="
 echo $1
 echo `whoami`
 echo $HOME
"

sudo -u UserA bash -c "{$cmd}" $ROOT_VAR

# result (no access to root variable parameter):

root
/root

None of them can access the variable set from the root user while at the same time running under the non-root user. Is it possible even by using parameters?

Answer 1

A slight modification of your first example should work:

cmd="
 echo $ROOT_VAR
 echo \`whoami\`
 echo \$HOME
"

sudo -H -u UserA bash -c "{$cmd}"

-H is needed to set the $HOME variable of the user based on this.

Regarding the backslashes, the distinction here between \$HOME and $ROOT_VAR is quite tricky. When the command is parsed, $ROOT_VAR is actually expanded to it's real value. In other words, the value of cmd is the following:

cmd="
  echo var-set-from-root
  echo `whoami`
  echo $HOME
"

You need to use backslashes to avoid parsing of whoami and $HOME in the root's environment and instead pass on the execution of the command to the user's bash itself.

Answer 2

# as root
var=1
export var
sudo -E -u kamil sh -c 'echo "$(whoami) var = $var"'
echo "$(whoami) var = $var"

will output:

kamil var = 1
root var = 1

1. sudo let's you run as another user
2. sueo -E allows to preserve environment, see man sudo
3. After sudoing, you need to execute a program - typically sh or bash for a script, sometimes with <<'EOF' for unexpanded multiline commands

The folllwing:

export var=1
sudo -E -u kamil sh <<'EOF'
echo "I am $(whoami) and..."
echo "var = $var"
echo "Let's change it!"
var=2
echo "var = $var"
EOF
echo "$(whoami) var = $var"

will output:

I am kamil and...
var = 1
Let's change it!
var = 2
root var = 1

You can always be even more explicit with env:

sudo -u kamil env var="$var" sh -c 'echo "$var"'

where you exactly choose what you pass around.