Does `sudo` work in terms of changing the effective user and group IDs of a process?

Question

Does sudo give the root's power to a command by changing the effective user and group IDs of the process of the command to be root?

If not, how does sudo work to accomplish that?

Answer 1

According to the man page:

sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.

[...]

When sudo executes a command, the security policy specifies the execution environment for the command. Typically, the real and effective user and group and IDs are set to match those of the target user, as specified in the password database, and the group vector is initialized based on the group database (unless the -P option was specified).

The following parameters may be specified by security policy:

• real and effective user ID
• real and effective group ID
• supplementary group IDs
• the environment list
• current working directory
• file creation mode mask (umask)
• SELinux role and type
• Solaris project
• Solaris privileges
• BSD login class
• scheduling priority (aka nice value)

To answer your question, changing the effective user and group ID's of a process is only one way of changing the privileges of a process, the security policy defined in sudo.conf can use any other kind of parameters in the above list.