Sudo vs root; any actual differences?
Hire the world's top talent on demand or became one of them at Toptal: https://topt.al/25cXVn
and get $2,000 discount on your first invoice
--------------------------------------------------
Music by Eric Matyas
https://www.soundimage.org
Track title: Magical Minnie Puzzles
--
Chapters
00:00 Sudo Vs Root; Any Actual Differences?
00:45 Answer 1 Score 25
01:10 Accepted Answer Score 41
03:28 Answer 3 Score 7
03:53 Answer 4 Score 0
04:25 Thank you
--
Full question
https://superuser.com/questions/771500/s...
--
Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...
--
Tags
#linux #commandline #sudo #root
#avk47
ACCEPTED ANSWER
Score 41
It strongly depends on how you call your program with sudo or su.
E.g. on the system on which I am in this moment:
.bashrc
COMMAND $HOME $USER Env. $PATH
1. sudo -i (root) root root [1]
2. sudo -s (USER) root USER /home/${USER}/bin:[1]
3. sudo /bin/bash (USER) root USER /home/${USER}/bin:[1]
4. sudo su (root) root USER [1]:/usr/games:/usr/local/games
5. sudo su - (root) root root [1]
Where [1]=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Env=Environment variables are reset for 1 and 5, taken from $USER in 2,3,4.
So a script, or a program that is launched with a different option can see different $PATH, $HOME, its shell can read different .bashrc,.profile and Environment variables. It reads the file related with the $HOME. Each user can modify his environment in a different way (variables, $PATH, .bashrc, .profile, .bash_profile, alias...). In particular a user can have a different order of the directories in his $PATH and, as a consequence, a script can execute a command e.g. in /home/$USER/bin instead then the one in the path expected from root.
You can run the program under sudo -i as you were logged as root with su -,
but you can have different behaviour if you run it with sudo MyCommand or with su -c MyCommand.
From man su:
In the description part:
The current environment is passed to the new shell. The value of $PATH is reset to /bin:/usr/bin for normal users, or /sbin:/bin:/usr/sbin:/usr/bin for the superuser
...
In the options part:
-, -l, --login
Provide an environment similar to what the user would expect had the user logged in directly.
From man sudo
-i, --login
Run the shell specified by the target user's password database entry as a login shell. This means that login-specific resource files such as .profile or .login will be read by the shell. If a command is specified, it is passed to the shell for execution via the shell's -c option. If no command is specified, an interactive shell is executed.sudoattempts to change to that user's home directory before running the shell. The command is run with an environment similar to the one a user would receive at log in. The Command Environment section in the sudoers(5) manual documents how the -i option affects the environment in which a command is run when the sudoers policy is in use.
ANSWER 2
Score 25
If you have full sudo access, you can become root using sudo su -, so the security point is moot.
Indeed, there is a way to discern the difference between a program ran as root and a program ran under sudo - using getuid vs geteuid - but this is a contrived trick. Why would a patch system do that?
ANSWER 3
Score 7
There are a few differences if you are getting a root shell, as pointed out by @Hastur.
If you are not getting a root shell, then there are more differences. The support member may have experience trying to do things like sudo patch -p0 < /root/patch.file where patch is run as root, but < (piping from a file) is not.
ANSWER 4
Score 0
It depends how fine grained you want the root access to be. If you have several users that perform different tasks on a system then sudo would be more ideal. One example I use frequently is the need to restart an application or database. Security is always best done least privileged. I use groups and only allow those groups to perform explicit actions. A good book that describes this process is "Sudo Mastery: User Access Control for Real People". Actually it is a good book about sudo in general...