Struct PrivilegedCommand 

pub struct PrivilegedCommand { /* private fields */ }

Builder for executing a program with elevated privileges.

Example

use privesc::Command;

let output = Command::new("/usr/bin/cat")
    .arg("/etc/shadow")
    .run()?;

Platform Behavior

• macOS: Uses osascript with AppleScript for GUI, sudo for CLI.
• Linux: Uses pkexec for GUI, sudo for CLI.
• Windows: Uses ShellExecuteExW with “runas” verb (UAC). Output capture is not available.

Implementations

impl PrivilegedCommand

pub fn new(program: impl Into<String>) -> Self

Creates a new Command for the given program.

Arguments

• program - The path to the program to execute with elevated privileges.

Examples found in repository

examples/basic.rs (line 4)

fn main() {
    let output = PrivilegedCommand::new("cat")
        .arg("/etc/shadow")
        .gui(true)
        .prompt("Administrator privileges required to read the test file")
        .run()
        .unwrap();

    println!("Exit status: {}", output.status);

    match output.stdout_str() {
        Some(stdout) => println!("Out: {stdout}"),
        None => println!("Out: <not available on this platform>"),
    }

    match output.stderr_str() {
        Some(stderr) => println!("Err: {stderr}"),
        None => println!("Err: <not available on this platform>"),
    }
}

examples/spawn.rs (line 7)

fn main() {
    // Spawn a privileged process without blocking
    let mut child = PrivilegedCommand::new("sleep").arg("2").spawn().unwrap();

    if let Some(id) = child.id() {
        println!("Spawned process with ID: {id}");
    }

    // Do some work while the process runs
    println!("Doing other work while process runs...");

    sleep(Duration::from_secs(1));

    // Check if the process has finished (non-blocking)
    match child.try_wait().unwrap() {
        Some(status) => println!("Process already finished with: {status}"),
        None => println!("Process still running..."),
    }

    // Wait for the process to complete
    println!("Waiting for process to finish...");
    let output = child.wait().unwrap();

    println!("Exit status: {}", output.status);
}

pub fn arg(self, arg: impl Into<String>) -> Self

Adds a single argument to pass to the program.

Examples found in repository

examples/basic.rs (line 5)

fn main() {
    let output = PrivilegedCommand::new("cat")
        .arg("/etc/shadow")
        .gui(true)
        .prompt("Administrator privileges required to read the test file")
        .run()
        .unwrap();

    println!("Exit status: {}", output.status);

    match output.stdout_str() {
        Some(stdout) => println!("Out: {stdout}"),
        None => println!("Out: <not available on this platform>"),
    }

    match output.stderr_str() {
        Some(stderr) => println!("Err: {stderr}"),
        None => println!("Err: <not available on this platform>"),
    }
}

examples/spawn.rs (line 7)

fn main() {
    // Spawn a privileged process without blocking
    let mut child = PrivilegedCommand::new("sleep").arg("2").spawn().unwrap();

    if let Some(id) = child.id() {
        println!("Spawned process with ID: {id}");
    }

    // Do some work while the process runs
    println!("Doing other work while process runs...");

    sleep(Duration::from_secs(1));

    // Check if the process has finished (non-blocking)
    match child.try_wait().unwrap() {
        Some(status) => println!("Process already finished with: {status}"),
        None => println!("Process still running..."),
    }

    // Wait for the process to complete
    println!("Waiting for process to finish...");
    let output = child.wait().unwrap();

    println!("Exit status: {}", output.status);
}

pub fn args<I, S>(self, args: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Adds multiple arguments to pass to the program.

pub fn gui(self, gui: bool) -> Self

Sets whether to use a GUI prompt for authentication.

• true: Use GUI prompt (AppleScript on macOS, pkexec on Linux, UAC on Windows)
• false: Use terminal-based sudo (default)

On Windows, this parameter is ignored as only UAC elevation is available.

Examples found in repository

examples/basic.rs (line 6)

fn main() {
    let output = PrivilegedCommand::new("cat")
        .arg("/etc/shadow")
        .gui(true)
        .prompt("Administrator privileges required to read the test file")
        .run()
        .unwrap();

    println!("Exit status: {}", output.status);

    match output.stdout_str() {
        Some(stdout) => println!("Out: {stdout}"),
        None => println!("Out: <not available on this platform>"),
    }

    match output.stderr_str() {
        Some(stderr) => println!("Err: {stderr}"),
        None => println!("Err: <not available on this platform>"),
    }
}

pub fn prompt(self, prompt: impl Into<String>) -> Self

Sets a custom prompt message for authentication.

On Windows, this is ignored as UAC displays its own prompt. On Linux with GUI mode, this is ignored due to pkexec limitations.

Examples found in repository

examples/basic.rs (line 7)

fn main() {
    let output = PrivilegedCommand::new("cat")
        .arg("/etc/shadow")
        .gui(true)
        .prompt("Administrator privileges required to read the test file")
        .run()
        .unwrap();

    println!("Exit status: {}", output.status);

    match output.stdout_str() {
        Some(stdout) => println!("Out: {stdout}"),
        None => println!("Out: <not available on this platform>"),
    }

    match output.stderr_str() {
        Some(stderr) => println!("Err: {stderr}"),
        None => println!("Err: <not available on this platform>"),
    }
}

pub fn run(&self) -> Result<PrivilegedOutput>

Executes the command with elevated privileges.

Returns

A PrivilegedOutput containing the exit status and optionally captured stdout/stderr. Note that stdout/stderr are None on Windows.

Examples found in repository

examples/basic.rs (line 8)

fn main() {
    let output = PrivilegedCommand::new("cat")
        .arg("/etc/shadow")
        .gui(true)
        .prompt("Administrator privileges required to read the test file")
        .run()
        .unwrap();

    println!("Exit status: {}", output.status);

    match output.stdout_str() {
        Some(stdout) => println!("Out: {stdout}"),
        None => println!("Out: <not available on this platform>"),
    }

    match output.stderr_str() {
        Some(stderr) => println!("Err: {stderr}"),
        None => println!("Err: <not available on this platform>"),
    }
}

pub fn spawn(&self) -> Result<PrivilegedChild>

Spawns the command with elevated privileges, returning a handle to the process.

Unlike run, this method returns immediately after spawning, allowing you to perform other work while the privileged process runs.

Returns

A PrivilegedChild handle that can be used to wait for the process to finish.

Platform Behavior

• macOS/Linux: Returns a handle wrapping the underlying process.
• Windows: Returns a handle wrapping the Windows process HANDLE.

Example

use privesc::PrivilegedCommand;

let child = PrivilegedCommand::new("/usr/bin/long-running-task")
    .spawn()?;

// Do other work...

let output = child.wait()?;

Examples found in repository

examples/spawn.rs (line 7)

fn main() {
    // Spawn a privileged process without blocking
    let mut child = PrivilegedCommand::new("sleep").arg("2").spawn().unwrap();

    if let Some(id) = child.id() {
        println!("Spawned process with ID: {id}");
    }

    // Do some work while the process runs
    println!("Doing other work while process runs...");

    sleep(Duration::from_secs(1));

    // Check if the process has finished (non-blocking)
    match child.try_wait().unwrap() {
        Some(status) => println!("Process already finished with: {status}"),
        None => println!("Process still running..."),
    }

    // Wait for the process to complete
    println!("Waiting for process to finish...");
    let output = child.wait().unwrap();

    println!("Exit status: {}", output.status);
}

Trait Implementations

impl Clone for PrivilegedCommand

fn clone(&self) -> PrivilegedCommand

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PrivilegedCommand

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.