Bash: Sudo keep-alive (good for long-running scripts that need sudo internally but shouldn't be run with sudo)

sudo-keepalive-example.sh

#!/bin/bash

# Might as well ask for password up-front, right?
sudo -v

# Keep-alive: update existing sudo time stamp if set, otherwise do nothing.
while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &

# Example: do stuff over the next 30+ mins that requires sudo here or there.
function wait() {
  echo -n "["; for i in {1..60}; do sleep $1; echo -n =; done; echo "]"
}
wait 0 # show reference bar
echo "$(sudo whoami) | $(date)"
wait 1
echo "$(sudo whoami) | $(date)"
wait 2
echo "$(sudo whoami) | $(date)"
wait 5
echo "$(sudo whoami) | $(date)"
wait 10
echo "$(sudo whoami) | $(date)"
wait 15
echo "$(sudo whoami) | $(date)"
wait 1
sudo -K
echo "$(whoami) | $(date)"
wait 2
echo "$(whoami) | $(date)"
wait 5
echo "done."

I’m trying to understand how this works. Won’t this keep on updating the sudo time stamp every 60 seconds for… forever? Or will it automatically stop at one point? I.e. when does the || exit get executed? Won’t kill -0 "$$" always have an exit status of 0, as you keep on running sudo -n every minute?

$$ is the PID of the parent process (eg. sudo-keepalive-example.sh). kill -0 PID exits with an exit code of 0 if the PID is of a running process, otherwise exits with an exit code of 1. So, basically, kill -0 "$$" || exit aborts the while loop child process as soon as the parent process is no longer running. Of course, it might be sleeping for 59 seconds before it figures this out, but it didn't seem like that was a real problem.

FWIW, I implemented this in my dotfiles script, and it seems to work well.

Ah, that explains it. Thanks! I’m stealing this for use in ~/.osx, if you don’t mind.

Simply perfect. Bravo. Really.
And thanks.

You my friend, deserve a medal

Hi thanks for this gist!

I do have a problem actually, which is really strange! I have an updateall script that takes care of my osx, npm, brew and pip updates and package upgrades.

the following asks for sudo password again right after echo "Next up: Npm", while ...

#!/bin/bash
echo "Get OS X Software Updates, and update installed Ruby gems, Homebrew, npm, pip and their installed packages"
echo "---"
echo "Let's ask for sudo upfront"

# Might as well ask for password up-front, right?
sudo -v

# Keep-alive: update existing sudo time stamp if set, otherwise do nothing.
while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &

echo "Next up: OSX Software Updates"

sudo softwareupdate -i -a

echo "Next up: Brew"

brew update && brew upgrade --all && brew cleanup && brew prune && brew doctor

echo "Next up: Npm"

sudo npm update npm -g
sudo npm update -g

echo "Next up: Pip"

pip install --upgrade pip
pip install --upgrade pip; pip freeze --local | grep -v '^\-e' | cut -d = -f 1  | xargs -n1 pip install -U

echo "done"

the following script doesn't (note only changed the position of npm before brew)

#!/bin/bash
echo "Get OS X Software Updates, and update installed Ruby gems, Homebrew, npm, pip and their installed packages"
echo "---"
echo "Let's ask for sudo upfront"

# Might as well ask for password up-front, right?
sudo -v

# Keep-alive: update existing sudo time stamp if set, otherwise do nothing.
while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &

echo "Next up: OSX Software Updates"

sudo softwareupdate -i -a

echo "Next up: Npm"

sudo npm update npm -g
sudo npm update -g

echo "Next up: Brew"

brew update && brew upgrade --all && brew cleanup && brew prune && brew doctor

echo "Next up: Pip"

pip install --upgrade pip
pip install --upgrade pip; pip freeze --local | grep -v '^\-e' | cut -d = -f 1  | xargs -n1 pip install -U

echo "done"

I am using stuff from both @cowboy and @mathiasbynens in my dotfiles, maybe you guys know whats up..

I was thinking about something like this but it doesn't handle the case where sudo expires immediately

@spudowiar, I recently changed my dotfiles to use the sledge-hammer approach to sudoing by adding myself to /etc/sudoers for the duration of the script, because anything else just wouldn't work reliably.

https://github.com/reitermarkus/dotfiles/blob/f104a8a7a592204a66646810ae8fbd956023c988/.sh#L43-L60

Maybe that will work for your case.

Awesome... That's exactly what I'm looking for. Unfortunately it does not work with a long running task like a massive brew install. After that, the sudo session is expired and you have to re-enter a password for the next sudo command. @cowboy Do you have any hints/experiences on that?!

I think the following statement:

while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &

Should be changed to:

while true; do sleep 60; sudo -n true; kill -0 "$$" || exit; done 2>/dev/null &

Because an immediate call to sudo right after the first one is not only redundant, but would also cause sudo to ask password again for the second real sudo call (at lease in my testing case).

Awesome... That's exactly what I'm looking for. Unfortunately it does not work with a long running task like a massive brew install. After that, the sudo session is expired and you have to re-enter a password for the next sudo command. @cowboy Do you have any hints/experiences on that?!

Homebrew explicitly invalidates the sudo timestamp, so AFAIK there's no way for this to work with brew.

@cowboy are you saying that this attempt at a solution didn't work? https://gist.github.com/cowboy/6733297

Has anyone tried this solution with the following sequence of commands:

sudo apt-get -y update
sudo apt-get -y upgrade
sudo apt-get -y autoremove

local packages=(tree curl unzip htop gconf-service gconf-service-backend gconf2
            gconf2-common libappindicator1 libgconf-2-4 libindicator7
            libpython2-stdlib python python2.7 python2.7-minimal libatomic1
            gimp vlc)

sudo apt-get -y install ${packages[@]}

sudo apt-get -y update

# At this point it asks me again the password
sudo apt-get -y install gufw

For me it didn't work.

Does sudo count the times is called along with the timeout? Because I see I'm using a few redundant apt-get update.

FYI: I'm running ubuntu 20.04