-1

For example, if I want to take the output of my dmesg I have to invoke it with elevated permission using sudo dmesg.

Now, say I want to monitor the output, I can put it in watch using either watch -n 1 sudo dmesg or sudo watch -n 1 dmesg. They both output the same thing.

My questions are:

  1. Is there any example that using sudo in different orders lead to different outputs?

  2. Is there any "standard" or formal notation in these cases? Should I wrap sudo before the whole wrapper, or should I put sudo at the command that requires elevated permission?

3
  • There's no pipe here.
    – muru
    Sep 10, 2019 at 2:25
  • @muru you're right. I called wrapper wrong. what a shame. Sep 10, 2019 at 3:21
  • 1
    The point was to see if you actually had some application of a pipe and if you forgot to mention it.
    – muru
    Sep 10, 2019 at 3:42

1 Answer 1

2

You are using a wrapper, not a pipe. Wrappers will carry their permissions with them.

In this instance for purely security reasons, please use

sudo watch dmesg

instead of

watch sudo dmesg

so that you trigger the sudo authentication only once. Otherwise it will continually refresh your authentication as sudo runs every second. If you then step away and someone walks up and ^C's your command they will be able to immediately sudo something else regardless of how long its been since you hit enter on that command.

In general, every command that needs elevation needs sudo:

sudo command1 | sudo command2

In the case of a wrapper, elevating a process will elevate any new processes that that process spawns. Only exception there are things that automatically run as another, non root user. Services that run under their own user, for example.

If you have several commands that are piped into eachother, all requiring elevation, it's usual to see them wrapped in an elevated bash sub-shell:

sudo bash -c "command1 | command2"
1
  • You're right. I confused wrapper and pipe. BTW, thank you very much, it makes sense that I should trigger sudo once. Sep 10, 2019 at 3:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .