Asked for sudo password only sometimes

Question

This is more of a curiousity, trying to learn more about linux permissions. So I don't understand why I am able to sudo certain commands and not be prompted for a password but not others. I know that /usr/bin/sudo has a SUID bit which obviously makes sense. I am trying to escalate privelges to root and was wondering if I would be able use /usr/bin/sudo in any way. (This is on an authorized machine don't worry)

Here I show that I am in fact david

david@traverxec:~/bin$ id
uid=1000(david) gid=1000(david) groups=1000(david),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)

Shows the SUID bit set for /usr/bin/sudo and the permissions on the two binaries in question

david@traverxec:~/bin$ ls -la /usr/bin/sudo
-rwsr-xr-x 1 root root 157192 Oct 12 09:49 /usr/bin/sudo

david@traverxec:~/bin$ ls -la /usr/bin/ls
-rwxr-xr-x 1 root root 138856 Feb 28  2019 /usr/bin/ls

david@traverxec:~/bin$ ls -la /usr/bin/journalctl 
-rwxr-xr-x 1 root root 67672 Aug 20  2019 /usr/bin/journalctl

Below Shows that this specific command using sudo to check logs of the webserver works perfectly and doesn't prompt me for a password!

david@traverxec:~/bin$ /usr/bin/sudo /usr/bin/journalctl -n5 -unostromo.service | /usr/bin/cat 
-- Logs begin at Mon 2020-03-02 12:00:21 EST, end at Mon 2020-03-02 12:11:05 EST. --
Mar 02 12:00:44 traverxec su[22169]: pam_unix(su:auth): authentication failure; logname= uid=33 euid=0 tty=pts/0 ruser=www-data rhost=  user=david
Mar 02 12:00:46 traverxec su[22169]: FAILED SU (to david) www-data on pts/0
Mar 02 12:07:26 traverxec nhttpd[23957]: /../../../../bin/sh sent a bad cgi header
Mar 02 12:07:38 traverxec nhttpd[24009]: /../../../../bin/sh sent a bad cgi header

When i try and run any other command using sudo I am prompted for a password

david@traverxec:~/bin$ /usr/bin/sudo /usr/bin/ls /etc/shadow
[sudo] password for david: 

Why is this?

Answer 1

As Kusalananda♦ already mentioned, you configure sudo through the configuration file where you can archive the behavior you describe.

A user can invoke a specific command without the condition of giving a password. This does not mean you have full sudo access. You only have the permission to run a single command.

Sample configuration for that:

david ALL=(ALL) NOPASSWD: /usr/bin/journalctl 

(more at https://askubuntu.com/questions/147241/execute-sudo-without-password)

• Even if you have a password for user "david" this does not automatically mean you can do anything more with sudo.
• There is no command for listing permissions which you got through sudo (without having access to /etc/sudoers). Its reasoned through how sudo works. Sudo just checks the configuration at the moment where you invoke a command with it - and this process needs superuser privileges. So there can't be an unprivileged tool which list the settings.

Personal advice: Try other methods for privilege escalations. Sudo is reasonable secure if the configuration is right.

Answer 2

sudo will remember that you have entered a password, and not prompt again for a while (this depends on the configuration).

The /etc/sudoers file has the configuration for sudo. You can set configure:

• which users
• which commands
• whether a password is needed.

It may be that it is set so that you can run some commands with no password.

All this has nothing to do with set-uid bit. This bit as you seem to know gives the program root privileges (see also capabilities: root is dead, long live capabilities). One sudo can do anything, it decides what to do based on its code, and the config file.