From d70e12db7513eeca1cfea692978e04c4e2f0da01 Mon Sep 17 00:00:00 2001 From: Matteo Nastasi Date: Sun, 13 Sep 2026 12:37:07 +0200 Subject: [PATCH] sql/builder.sh: sudo instead of su "su root -c" asks for the root password, which on a freshly installed debian does not even exist: the first user administers with sudo. The two commands were also nested (su root calling su postgres) with three levels of quoting to get through, and the variables ended up in the string unprotected. Now it goes straight to "sudo -u postgres" and the arguments are quoted. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014M1jiEq9cHdE5SE5j6vFuE --- sql/builder.sh | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/sql/builder.sh b/sql/builder.sh index db1dcd1..55df977 100755 --- a/sql/builder.sh +++ b/sql/builder.sh @@ -145,16 +145,18 @@ test "$DBUSER" != "" && pg_args="$pg_args -U $DBUSER" test "$DBPORT" != "" && pg_args="$pg_args -p $DBPORT" test "$DBBASE" != "" && pg_args="$pg_args $DBBASE" - case $CMD in "create") - echo "su root" - su root -c "su postgres -c \"echo \\\"DBUser passwd: $DBPASS\\\" ; createuser -S -D -R -P $DBUSER && createdb -E utf8 -O $DBUSER $DBBASE\"" + echo "sudo -u postgres" + echo "DBUser passwd: $DBPASS" + sudo -u postgres createuser -S -D -R -P "$DBUSER" \ + && sudo -u postgres createdb -E utf8 -O "$DBUSER" "$DBBASE" ;; "destroy") - echo "su root" - su root -c "su postgres -c \"dropdb $DBBASE && dropuser $DBUSER\"" + echo "sudo -u postgres" + sudo -u postgres dropdb "$DBBASE" \ + && sudo -u postgres dropuser "$DBUSER" ;; "clean") ( echo "-- MESG: clean start" ; one_or_all $2 | egrep "$MATCH_DROP|^-- MESG|^-- FILE " | tac ; echo "-- MESG: clean end" ; ) | sqlexe -- 2.47.3