Sudo vs root; any actual differences?
Hire the world's top talent on demand or became one of them at Toptal: https://topt.al/25cXVn
and get $2,000 discount on your first invoice
--------------------------------------------------
Music by Eric Matyas
https://www.soundimage.org
Track title: Magical Minnie Puzzles
--
Chapters
00:00 Sudo Vs Root; Any Actual Differences?
00:45 Answer 1 Score 25
01:10 Accepted Answer Score 41
03:28 Answer 3 Score 7
03:53 Answer 4 Score 0
04:25 Thank you
--
Full question
https://superuser.com/questions/771500/s...
--
Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...
--
Tags
#linux #commandline #sudo #root
#avk47
ACCEPTED ANSWER
Score 41
It strongly depends on how you call your program with sudo
or su
.
E.g. on the system on which I am in this moment:
.bashrc
COMMAND $HOME $USER Env. $PATH
1. sudo -i (root) root root [1]
2. sudo -s (USER) root USER /home/${USER}/bin:[1]
3. sudo /bin/bash (USER) root USER /home/${USER}/bin:[1]
4. sudo su (root) root USER [1]:/usr/games:/usr/local/games
5. sudo su - (root) root root [1]
Where [1]=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Env=Environment variables are reset for 1 and 5, taken from $USER in 2,3,4.
So a script, or a program that is launched with a different option can see different $PATH
, $HOME
, its shell can read different .bashrc
,.profile
and Environment variables. It reads the file related with the $HOME
. Each user can modify his environment in a different way (variables, $PATH
, .bashrc, .profile, .bash_profile, alias...). In particular a user can have a different order of the directories in his $PATH
and, as a consequence, a script can execute a command e.g. in /home/$USER/bin
instead then the one in the path expected from root.
You can run the program under sudo -i
as you were logged as root with su -
,
but you can have different behaviour if you run it with sudo MyCommand
or with su -c MyCommand
.
From man su
:
In the description part:
The current environment is passed to the new shell. The value of $PATH is reset to /bin:/usr/bin for normal users, or /sbin:/bin:/usr/sbin:/usr/bin for the superuser
...
In the options part:
-, -l, --login
Provide an environment similar to what the user would expect had the user logged in directly.
From man sudo
-i, --login
Run the shell specified by the target user's password database entry as a login shell. This means that login-specific resource files such as .profile or .login will be read by the shell. If a command is specified, it is passed to the shell for execution via the shell's -c option. If no command is specified, an interactive shell is executed.sudo
attempts to change to that user's home directory before running the shell. The command is run with an environment similar to the one a user would receive at log in. The Command Environment section in the sudoers(5) manual documents how the -i option affects the environment in which a command is run when the sudoers policy is in use.
ANSWER 2
Score 25
If you have full sudo
access, you can become root
using sudo su -
, so the security point is moot.
Indeed, there is a way to discern the difference between a program ran as root
and a program ran under sudo
- using getuid
vs geteuid
- but this is a contrived trick. Why would a patch system do that?
ANSWER 3
Score 7
There are a few differences if you are getting a root shell, as pointed out by @Hastur.
If you are not getting a root shell, then there are more differences. The support member may have experience trying to do things like sudo patch -p0 < /root/patch.file
where patch
is run as root, but <
(piping from a file) is not.
ANSWER 4
Score 0
It depends how fine grained you want the root access to be. If you have several users that perform different tasks on a system then sudo would be more ideal. One example I use frequently is the need to restart an application or database. Security is always best done least privileged. I use groups and only allow those groups to perform explicit actions. A good book that describes this process is "Sudo Mastery: User Access Control for Real People". Actually it is a good book about sudo in general...