{"id":31446739,"url":"https://github.com/talwrii/killable-sudo","last_synced_at":"2026-01-20T16:41:49.583Z","repository":{"id":301226414,"uuid":"1008595033","full_name":"talwrii/killable-sudo","owner":"talwrii","description":"Run a process with sudo but allow the user who ran it to kill it","archived":false,"fork":false,"pushed_at":"2025-09-06T17:56:41.000Z","size":527,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-09-06T19:35:45.346Z","etag":null,"topics":["kill","sudo"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/talwrii.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-06-25T19:41:00.000Z","updated_at":"2025-09-06T17:56:44.000Z","dependencies_parsed_at":null,"dependency_job_id":"17081b3f-9ccb-4917-a740-d710bfb5e7b6","html_url":"https://github.com/talwrii/killable-sudo","commit_stats":null,"previous_names":["talwrii/killable-sudo"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/talwrii/killable-sudo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/talwrii%2Fkillable-sudo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/talwrii%2Fkillable-sudo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/talwrii%2Fkillable-sudo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/talwrii%2Fkillable-sudo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/talwrii","download_url":"https://codeload.github.com/talwrii/killable-sudo/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/talwrii%2Fkillable-sudo/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":277778005,"owners_count":25875398,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-30T02:00:09.208Z","response_time":75,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kill","sudo"],"created_at":"2025-10-01T01:00:28.782Z","updated_at":"2025-10-01T01:00:34.254Z","avatar_url":"https://github.com/talwrii.png","language":"Python","readme":"# Killable sudo\n**@readwithai** - [X](https://x.com/readwithai) - [blog](https://readwithai.substack.com/) - [machine-aided reading](https://www.reddit.com/r/machineAidedReading/) - [📖](https://readwithai.substack.com/p/what-is-reading-broadly-defined\n)[⚡️](https://readwithai.substack.com/s/technical-miscellany)[🖋️](https://readwithai.substack.com/p/note-taking-with-obsidian-much-of)\n\nA wrapper around sudo which allows you to kill a process run with sudo as a normal user.\n\nThis is really intended for a [limited set of commands run as sudo without a password](https://unix.stackexchange.com/questions/215412/allow-certain-guests-to-execute-certain-commands) rather than 'full root\" access - since a user with full root access via sudo can kill processes with `sudo kill`. My personal motivation was running processes started by a service manager not running as root.\n\nIt is also to be noted that similar effects can be achieved with [progress groups](https://www.andy-pearce.com/blog/posts/2013/Aug/process-groups-and-sessions/), which is the feature which allows `Ctrl-C` to kill process run with `sudo`. You can kill a process group by using kill with negative integers.\n\n![logo](./logo.png)\n\n## Motivation\nI was setting up a little router on a box which combines together a few services and a little glue. Naturally, as a router some of the things want to run as root,  but I didn't feel like running everything is a root. So I fell back to using sudo to provide access to a limited set of processes. `sudo` gives you nice fine-grained control over the commands that a user can run and is a nice alternative to setuid and can limit access to certain users so it seems a nice approach.\n\nBut I came across a problem: once you have started something with sudo you cannot kill it - or at least many server managers which use normal [signals](https://man7.org/linux/man-pages/man7/signal.7.html) to kill processes cannot.\n\nAs quick hack, I decided to vibe-code something which allows you to run a process with sudo and then kill it normally once you are done.\n\n## How killable-sudo works\nWhen you run a process with `killall-sudo` you create two shim processes. A user shim which exists to be killed with signals and tell the root shim, and a root shim that exists to kill the underlying process. When the user shim is killed it sends a message to the root shim via a fifo and that then kills the real process (and it's children).\n\n`killable-sudo` will run this root shim process using `sudo`. So whatever user is using killable-sudo must be able run the root shim installed at `/opt/killable-sudo/killable-sudo` with sudo for examples [with a sudoers entry](https://toroid.org/sudoers-syntax) like this:\n\n```\nuser ALL=(root) NOPASSWD: /opt/killable-sudo/killable-sudo\n```\n\nOf course, if your user has traditional password based sudo access, you could just type in your password rather than edit sudoers - but one of the use cases for `killable-sudo` is automated users which can run a limited set of processes as root.\n\nThis shim is running as root by the standard, so acts as an attack surface for privilege escalation. It was also written with some (slightly audited) vibe coding... which might not be the best of ideas! It is nevertheless a short, easily-revieawable section of Python code with no library dependencies (apart from Python itself - which isn't so short). Caveat emptor!\n\n## Installation\nFirst install the code using [pipx](https://github.com/pypa/pipx):\n\n```\npipx install killable-sudo\n```\n\nYou then need to install the root shim using `sudo killable-sudo --install` and give `sudo` the ability to run this shim as root for whatever user you are using. You can do this by adding the following entry to the sudoers file with `visudo`\n\n\n```\nuser ALL=(root) NOPASSWD: /opt/killable-sudo/killable-sudo\n```\n\n## Usage\n`killable-sudo` is run like like `sudo`, e.g.\n\n```\nkillable-sudo top\n```\n\nThis will spawn a tree of processes - which eventually runs `sudo top` as the user who executed this command. If you send kill signal to the top process then this entire tree will exit.\n\n## About me\nI am **@readwithai**. I create tools for reading, research and agency sometimes using the markdown editor [Obsidian](https://readwithai.substack.com/p/what-exactly-is-obsidian).\n\nI also create a [stream of tools](https://readwithai.substack.com/p/my-productivity-tools) that are related to carrying out my work. You may be interested in some of these tools.\n\nI write about lots of things - including tools like this - on [X](https://x.com/readwithai).\nMy [blog](https://readwithai.substack.com/) is more about reading and research and agency.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftalwrii%2Fkillable-sudo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftalwrii%2Fkillable-sudo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftalwrii%2Fkillable-sudo/lists"}