-1

Please note: I am not asking "what does sudo do" of which I know the answer.

There are plenty of IT systems that have no concept of sudo - instead, each system user is either an "admin user" (meaning he has all system privileges turned on as soon as he log in), or they are some lesser privileged "general user".

To give a hypothetical example. If Gmail suddenly announced that on top of your usual Gmail password, you'll now have to enter an additional "sudo" password each time you want to send or receive an email, I would react by asking "what is the purpose, given I have already provided a password to access all privileges associated with this account?"

I ask the same question of sudo. If I have already provided a username and password to access a system, why can't the system just recognise my user account as having admin privileges - with no need to enter an additional sudo password?

  • FYI askubuntu.com/questions/147241/execute-sudo-without-password for your sudo without a password setup. – chai Sep 20 '18 at 1:37
  • 2
    To close voters: this question is not opinion based. It is about system design and can be meaningfully answered. – sebasth Sep 20 '18 at 6:13
  • "why can't the system just recognise my user account as having admin privileges - with no need to enter an additional sudo password?" Please, configure it do so. sudo can be easily setup to not require your password. That's what NOPASSWD rules are for. – muru Sep 20 '18 at 6:41
2

There's a number of concepts here, that are common in the security world.

Firstly, we always want users to run with "least necessary privilege". The idea, especially in an enterprise environment (I'll get to this bit later), is that we want people to have the permissions they need to use the computer, but no more. "Business as usual" (BAU) doesn't require changing files in /etc; that's an exception case.

This leads to the next part; "privilege escalation". Once something outside of BAU is determined, we want the user to be aware they're doing something more privileged. So use the sudo command and re-enter your password to confirm you know what you're doing. This re-entering of the password is important, because it means that the user is consciously approving this action. It doesn't necessarily have to be a password, either; there are versions which can require 2 factor authentication, that will keystroke log your session and record it for later playback...

So now we come to "enterprise" and we look at the lessons from Windows XP Home Edition. In that, the user you created at installation (or first-boot for OEM) automatically had admin permissions. You always ran as admin. Which meant that any mistake you made might delete critical files. Or any of the bugs (eg in email, or image rendering, or...) that allowed an attacker to perform actions automatically had admin. This is one reason why viruses and malware ran rampant in older Windows versions.

So the separation of "BAU" and "privileged" activities extend beyond the enterprise and into the home, and into the single-user environment. It's worth noting that from Vista onward even Windows has the concept of "you're trying to do something privileged; re-enter your password".

Summary: sudo is just a way switching security contexts; from activity you could reasonably expect to do every day ('read email', 'create a document', 'browse the web') and stuff that is considered privileged ('create a new user', 'change system configuration', 'delete files owned by another user'...).

For most home users, just having the "re-enter your password" is sufficient. For an enterprise things can get a lot more complicated; see https://www.sweharris.org/post/2018-08-26-minimal-sudo/ for an example of some of the concerns.

EDIT TO ADD:

I should also point out that Unix also has the concept of an "admin user"; this is the "root" account. In an enterprise environment we don't like people using this because we don't know if Tom, Dick or Harry have used the root account to make changes. sudo is a way of allowing people to escalate their privileges in an auditable least privileged way. Tom can run sudo cat and read any file but can not reboot the machine; Dick and Harry can sudo reboot to reboot the machine but can't read protected files.

In this way sudo allows for minimal privileges needed to fulfill a role to be assigned. Which is a key security requirement.

1

It is a really bad idea to run everything as root, because if I told you to run rm -rf / as root, it would delete your entire Operating System, and without root it would fail. The point of having sudo is to allow you to elevate privelleges only when necessary. This is to prevent malicious scripts from having root the moment they are run, or a bug in the program you are running that would allow someone to get the permissions of the program (root).

  • If I ran code rm -ef / as a user without admin permissions, it would likewise fail. This doesn't explain why we need sudo. – Callum Sep 20 '18 at 0:56
  • It would fail because the command is not run with the necessary permissions. This is a good thing if you don't want regular everyday programs to delete your OS. With sudo, you have to enter a password each time you need to give a program access to potentially irreversible commands such as rm -rf /. This allows more control over your system, since every program can't delete everything, or do other malicious things. – Giraffer Sep 20 '18 at 1:00
0

On Linux, in a sense, there such are "permissions" known as Linux capabilities. The idea behind capabilities is to split superuser privileges into smaller parts. This would allow a process to have only necessary minimum subset of superuser privileges.

Linux 4.3 included an ambient capabilities, which allows a process to keep effective capabilities after execv. This could be used to build a mechanism to allow non-root users to have effective capabilities by default.

There is also separate inheritable capabilities set, which works somewhat differently. Inheritable capabilities can become effective only if the capability was included in file capabilities, allowing only certain executables to run with elevated capabilities.

As the other answers pointed out, it is not safe to use a privileged user for other tasks than system administration. The damage an unprivileged process (and user) can do to the system is limited. To keep the system somewhat secure, it is easier to elevate privileges only when necessary by user action, than remembering to drop them every occasion they are not required.

Also, in a way, sudo does associate your user with the administrative role via its configuration. It provides an interface to use for performing administrative tasks requiring superuser privileges. It is possible to configure sudo to not to prompt password. About possible security issues, see Information Security SE: How secure is NOPASSWD in passwordless sudo mode?

For further reading, I recommend capabilities man page for good overview and [RFC] capabilities: Ambient capabilities which explains rationale for ambient capabilities and problems in earlier inheritable capabilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.