在什么情况下，文件无法在bash中工作？

Question

If I run sudo du -sh <some_directory>/* on a directory which requires root access it works and lists out the total sizes for all directories in . However I have found at least one scenario in which this does not happen:

sudo du -sh /var/lib/docker/*

http://tldp.org/LDP/abs/html/globbingref.html doesn't mention any scenarios in which this wouldn't be expected to work. Does anyone have any ideas why this might not work? Is it related to Docker or du or is it wholly related to globbing.

Answer 1

The comments already mentioned it in brief, but to have a decent answer on the question and a more detailed explanation:

In the command

sudo du -sh /var/lib/docker/*

The globbing you are performing takes place before the sudo is executed. Only the call of du is done with root permissions. That means if the directory /var/lib/docker/ is restricted for you as a normal user and you cannot read it (missing r permissions), then the globbing asterisk will not evaluate to anything. Default setting in the bash then is to leave it unchanged, so the string remains /var/lib/docker/* .

Then the arguments du , -sh , and /var/lib/docker/* are passed to sudo which then executes du with root permissions and passes the arguments -sh and /var/lib/docker/* . du then tries to find a file with exactly this name and will probably find nothing because no file in there is named * .

Do achieve what you want you need to make the globbing be done with root permissions also. For this you need to start a shell (only shells do the globbing) with root permissions:

sudo bash -c 'du -sh /var/lib/docker/*'

This way, the arguments bash , -c and du -sh /var/lib/docker/* are passed to the command sudo . Then sudo starts the bash with root permissions and passes the commands -c , du -sh /var/lib/docker/* . Then the bash understands because of the -c options that is supposed to evaluate and execute the command du -sh /var/lib/docker/* . It then splits the command by spaces into the "words" du , -sh , and /var/lib/docker/* . Now it performs any necessary globbing expansion (with root permissions, so it is allowed to read the contents of the directory /var/lib/docker/ ) on each of the words. It will replace the last word by /var/lib/docker/aufs , /var/lib/docker/builder , /var/lib/docker/buildkit , and several more. As a last step it will call du with -sh and the result of the globbing expansion. Root permissions will be inherited for this, so du then also runs with them.