How can I apply the principle of least privilege to Bash scripts on a Linux system?

Answer the question first

To confine a Bash script to only the operations it truly needs, create a dedicated non‑root user, lock down filesystem permissions, and use a tightly scoped sudoers entry for any privileged commands. Verify the setup by running the script as that user and checking what it can actually do; if something breaks, revert the changes.

Confirmed steps (based on established Linux security practices)

1. Create a dedicated account

   sudo adduser --system --group --no-create-home scriptuser

2. Set ownership and mode on the script

   sudo chown root:scriptuser /opt/myscript/myscript.sh
   sudo chmod 750 /opt/myscript/myscript.sh

3. Restrict filesystem access for the script’s data
   • Log files (read‑only):

     sudo chown root:adm /var/log/myapp/*
     sudo chmod 640 /var/log/myapp/*

   • Target directory (write‑only):

     sudo mkdir -p /var/lib/myapp/output
     sudo chown scriptuser:scriptuser /var/lib/myapp/output
     sudo chmod 750 /var/lib/myapp/output

4. Configure a minimal sudoers rule

   # Use visudo to edit safely
   sudo visudo
   # Add a line like:
   scriptuser ALL=(root) NOPASSWD: /usr/bin/customtool --option

   Replace /usr/bin/customtool --option with the exact command and arguments the script needs to run with elevated privileges.

5. Hardening inside the script

   #!/usr/bin/env bash
   set -euo pipefail   # abort on error, unset var, or failed pipe
   umask 027           # new files: owner rwx, group rx, others none
   # Example of using sudo for the privileged step
   if ! sudo /usr/bin/customtool --option; then
       echo \"Privileged step failed\" >&2
       exit 1
   fi
   # Rest of script runs as scriptuser, accessing only the pre‑set paths

Verification (what to check)

• Run the script as the dedicated user and confirm it succeeds without prompting for a password:

  sudo -u scriptuser /opt/myscript/myscript.sh

• List allowed sudo commands for the user:

  sudo -l -U scriptuser

  Only the intended command should appear.

• Inspect file permissions:

  ls -l /opt/myscript/myscript.sh
  ls -l /var/log/myapp/*
  ls -ld /var/lib/myapp/output

Rollback procedure

1. If the script fails because it lacks a needed privilege, temporarily add the missing command to the sudoers line, test, then remove it once the script is adjusted.
2. To revert the dedicated user and its files:

   sudo deluser --remove-home scriptuser
   sudo delgroup scriptuser
   # Remove any leftover directories or adjust permissions as needed

3. Restore original permissions on log files or directories if they were changed:

   sudo chown root:adm /var/log/myapp/*
   sudo chmod 640 /var/log/myapp/*
   sudo chown root:root /var/lib/myapp/output
   sudo chmod 755 /var/lib/myapp/output

Assumptions and uncertainty

The steps assume the script’s required privileged operation can be expressed as a single, non‑interactive command (or a small set of commands) that is safe to allow via sudo. If the script needs to run a complex suite of binaries or edit files in multiple locations, further refinement of the sudoers rule or use of Linux capabilities/containers may be necessary. In such cases, please provide the exact list of privileged actions so the sudoers entry can be tightened accordingly.