To launch a root shell on machines where the root account is disabled, you can run one of:

  • sudo -i : run an interactive login shell (reads /root/.bashrc and /root/.profile)
  • sudo -s : run a non-login interactive shell (reads /root/.bashrc)

In the Ubuntu world, I very often see sudo su suggested as a way to get a root shell. Why run two separate commands when one will do? As far as I can tell, sudo -i is equivalent to sudo su - and sudo -s is the same as sudo su.

The only differences seem to be (comparing sudo -i on the left and sudo su - on the right):

screenshot of meld comparing 'sudo -i' and 'sudo su -'

And comparing sudo -s (left) and sudo su (right):

screenshot of meld comparing 'sudo -s' and 'sudo su'

The main differences (ignoring the SUDO_foo variables and LS_COLORS) seem to be the XDG_foo system variables in the sudo su versions.

Are there any cases where that difference warrants using the rather inelegant sudo su? Can I safely tell people (as I often have) that there's never any point in running sudo su or am I missing something?

  • 7
    I've never understood those fancy systems like ubuntu which prevent users from standard su -. They created problem and now there are endless discussions on how to solve it. – jimmij Jul 24 '15 at 14:30
  • 15
    @jimmij Don't you need to know root password with su -? Don't you think that poses a security hole in multi-user environments, where more than one person needs to have root access? – Erathiel Jul 24 '15 at 15:03
  • 3
    @Christopher The problem is not one of the user that have sudo privilege or the root password to hack the system. The problem is about password safety. When you change the root password, you need to let all users who needs it to know, which can be difficult. With sudo, you don't have this difficulty. – Huygens Jul 24 '15 at 20:24
  • 3
    What is the diff tool? – Josh The Geek Jul 24 '15 at 20:49
  • 4
    @jimmij How does Ubuntu prevent the use of su -? Yes, one would have to set a root password, but that's trivial. – Phizes Jul 24 '15 at 23:05
up vote 54 down vote accepted

As you stated in your question, the main difference is the environment.

sudo su - vs. sudo -i

In case of sudo su - it is a login shell, so /etc/profile, .profile and .bashrc are executed and you will find yourself in root's home directory with root's environment.

sudo -i is nearly the same as sudo su - The -i (simulate initial login) option runs the shell specified by the password database entry of the target user as a login shell. This means that login-specific resource files such as .profile, .bashrc or .login will be read and executed by the shell.

sudo su vs. sudo -s

sudo su calls sudo with the command su. Bash is called as interactive non-login shell. So bash only executes .bashrc. You can see that after switching to root you are still in the same directory:

user@host:~$ sudo su
root@host:/home/user#

sudo -s reads the $SHELL variable and executes the content. If $SHELL contains /bin/bash it invokes sudo /bin/bash, which means that /bin/bash is started as non-login shell, so all the dot-files are not executed, but bash itself reads .bashrc of the calling user. Your environment stays the same. Your home will not be root's home. So you are root, but in the environment of the calling user.

Conclusion

The -i flag was added to sudo in 2004, to provide a similar function to sudo su -, so sudo su - was the template for sudo -i and meant to work like it. I think it doesn't really matter which you use, unless the environment isn't important.

Addition

A basic point that must be mentioned here is that sudo was designed to run only one single command with higher privileges and then drop those privileges to the original ones. It was never meant to really switch the user and leave open a root shell. Over the time, sudo was expanded with such mechanisms, because people were annoyed about why to use sudo in front of every command.

So the meaning of sudo was abused. sudo was meant to encourage the user to minimize the use of root privileges.

What we have now, is sudo becomes more and more popular. It is integrated in nearly every well known linux distribution. The original tool to switch to another user account is su. For an old school *nix veteran such thing like sudo might seem needless. It adds complexity and behaves more likely to the mechanisms we know from Microsofts os-family, and thus is in contrary to the philosophy of simplicity of *nix systems.

I'm not really a veteran, but also in my opinion sudo was always a thorn in my side, from the time is was introduced and I always worked around the usage of sudo, if it was possible. I am most reluctant to use sudo. On all my systems, the root account is enabled. But things change, maybe the time will come, when su will be deprecated and sudo replaces su completely.

Therefore I think, it will be the best to use sudo's internal mechanisms (-s, -i) instead of relying on an old tool such as su.

  • 3
    Ah, so before 2004 there was actually a reason to run sudo su then? At the time I was using distros without sudo and active root accounts so I don't know. That might explain the prevalence of the sudo su meme in the Ubuntu world. – terdon Jul 24 '15 at 18:34
  • 7
    I never knew about sudo -i or sudo -s before - I've been running UNIXes of various sorts since 1991 and for me sudo su - is just an ingrained habit at this point. – fluffy Jul 24 '15 at 20:25
  • 1
    Is sudo -s the same as sudo $SHELL then? – Samuel Edwin Ward Jul 24 '15 at 23:11
  • 2
    (Agreeing with @chaos) The reasons to use sudo su - are 1) that it works and you know exactly what it does, and 2) that you don't have to remember another option to sudo (when you already know su -) and 3) you don't have to remember which version of sudo you're working with at the moment. Why remember one more piece of trivia when what you already have works fine? Is there anything that su -i does better other than avoid a log entry? I don't use sudo su - enough to worry about that. – jrw32982 Jul 29 '15 at 4:10
  • 2
    I just saw the update, very nice! For the record, let me state that I too cut my *nix teeth on systems with no sudo and am very used to su. It's the combination of the two that bugs me. – terdon Sep 3 '15 at 12:30

To answer your question directly: no, there is no good reason to do this. Also, sudo su produces two log entries when one would suffice.

I've seen many people do this, and when I ask why they don't just run sudo -s, the answer is just that they don't know about the -s flag to sudo, and generally they switch after I point it out.

However, to your list of sudo -s and sudo -i, I'd like to add one more option, sudo -sE, which is kind of a replacement for su -m. sudo -sE preserves your environment including home directory. This has risks if your home directory is insecure (on NFS). But in an environment where many people use root, it saves you from having to agree on the contents of the root .bashrc file. My .bashrc contains many specializations for root, so I don't get exactly the same environment as root, but at least I get exactly the environment I want.

  • 4
    If it preserves your environment, including $HOME, that means all new files created under the home folder are owned by root, not by you. I've had this cause many hard to diagnose permission errors. – Eris Jul 25 '15 at 22:38
  • sudo -sE and then echo $HOME gives /root on CentOS 7, bash 4.2. -sE does not appear to preserve home directory as you stated. – jeremysprofile Aug 10 at 21:33

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.