I'd like to be able to run a script as another user, and only as that user.The way I currently have this set up is to havealice   ALL = (bob) NOPASSWD: /home/alice/script.shin the sudoers file andalice@foo:~$ ls script.sh-rwxr-xr-x  1 root  root ..... script.shalice@foo:~$ lsattr script.sh----i----------- script.shalice@foo:~$ head -1 script.sh#!/bin/bashalice@foo:~$ sudo -u bob ./script.shokIs there a way to have the shebang line be something like#!/usr/bin/sudo -u bob -- /bin/bashso that alice could just runalice@foo:~$ ./script.shok?If I try this I simply get the error messagesudo: unknown user:  blog -- /bin/bashsudo: unable to initialize policy plugin  
`sudo -u user` in shebang line
sudo;shebang
Linux (like many other Unix variants) only supports passing a single argument to the interpreter of a script. (The interpreter is the program on the shebang line.) A script starting with #!/usr/bin/sudo -u bob -- /bin/bash is executed by calling /usr/bin/sudo with the arguments -u bob -- /bin/bash and /home/alice/script.sh.One solution is to use a wrapper script: make /home/alice/script.sh contain#!/bin/shexec sudo -u bob /home/alice/script.realand put the code in /home/alice.script.real starting with #!/bin/bash and make the sudo rule refer to /home/alice.script.real.Another solution is to make the script reexecute itself. You need to be careful to detect the desirable condition properly, otherwise you risk creating an infinite loop.#!/bin/bashif ((EUID != 123)); then  exec sudo -u \#123 /home/alice/script.shfi(where 123 is the user ID of bob)A simple solution is to tell people to run sudo -u bob /home/alice/script.sh instead of running the script directly. You can provide shell aliases, .desktop files, etc.