0

Does sudo give the root's power to a command by changing the effective user and group IDs of the process of the command to be root?

If not, how does sudo work to accomplish that?

  • Yes, generally that's what it does. Though sudo is very powerful and can be configured to do other things too. – Tanmay Dec 28 '16 at 11:51
1

According to the man page:

sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.

[...]

When sudo executes a command, the security policy specifies the execution environment for the command. Typically, the real and effective user and group and IDs are set to match those of the target user, as specified in the password database, and the group vector is initialized based on the group database (unless the -P option was specified).

The following parameters may be specified by security policy:

  • real and effective user ID
  • real and effective group ID
  • supplementary group IDs
  • the environment list
  • current working directory
  • file creation mode mask (umask)
  • SELinux role and type
  • Solaris project
  • Solaris privileges
  • BSD login class
  • scheduling priority (aka nice value)

To answer your question, changing the effective user and group ID's of a process is only one way of changing the privileges of a process, the security policy defined in sudo.conf can use any other kind of parameters in the above list.

  • Thanks. (1) Are both real and effective user/group IDs changed to those of the target user? or just the effective user/group IDs? (2) "changing the effective user and group ID's of a process is only one way of changing the privileges of a process". What are other ways of changing the privileges of a process? See See unix.stackexchange.com/questions/440316/… – Tim Apr 27 '18 at 2:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.