4

I am new to Linux, so bear with me for my lack of understanding.

Imagine there are 2 users in my linux installation, say A and B.

User A creates a folder FolderA and adds some files inside this folder. User A then uses the chmod command to block the folder for access by anyone else using the following command

sudo chmod 700 FolderA -R

What I dont understand is how User B can just log into his account and change this restriction using the command as follows.

sudo chmod 777 FolderA -R

I mean whats the point in setting restrictions to a folder when anyone can change it? I just dont understand the logic of this.

Once again, I am new to Linux and hence this question.

  • 20
    Not anyone can do ‘sudo’. Only designated users can issue this command. Read about admin privileges in linux. – dingalapadum Oct 18 at 22:27
  • 4
    Mandatory XKCD: xkcd.com/838 – Bernhard Döbler Oct 19 at 16:05
32

The sudo command gives temporary adminstrator privileges to a user. If you use this then you bypass any security controls. On a managed multiuser system very few users would have this right - typically just the system administrators. On a home system it's probably that you would have this by default so that you can look after your own system.

Remove FolderA entirely. Then try the commands again without using sudo and see what happens

| improve this answer | |
  • 8
    @LinuxMantri whoever created the user accounts gave them rights to use sudo – roaima Oct 17 at 20:35
  • 25
    This is a great example of why slapping sudo in front of every command is a bad idea. – Criggie Oct 17 at 21:31
  • 6
    LinuxMantri - Generally there will be a group (probably 'admin', but depends on the distro) that is used to allow access to sudo. Remove the user from that group and they will no longer be able to use sudo. Alternatively, look into the syntax of the /etc/sudoers file if you want to allow some users to use only a limited subset of commands with sudo. That will enable much more fine grained control if that is what you need. – Adam Luchjenbroers Oct 18 at 1:19
  • 4
    @DavidZ it depends on the distribution and or Linux/UNIX flavour – roaima Oct 18 at 10:45
  • 8
    On the Linux distributions I use regularly the group is called sudo. BSD derived systems often prefer wheel. Personally I've not come across one using admin but without knowing the OP's environment none of this is really helpful to them. (If they come back and ask how to create a user without default root sudo rights we can then ask what distribution or platform they're using, and how they're creating a user account, and then tailor the response accordingly.) – roaima Oct 18 at 10:52
11

Using sudo from a user account means that you are no longer operating as that user, but as the super user. As far as the system is concerned, userA and userB have the same privileges - they are both the super user, in other words.

If you wish to limit the privileges of one user under sudo, you can do that in the sudoers file via the command sudo visudo. Note that the sudoers file must be opened for editing in this way.

# This file MUST be edited with the 'visudo' command as root.

| improve this answer | |
  • 2
    If you want to use, say, Emacs to edit your sudoers file, use sudo EDITOR=emacs visudo. – Andrew Ray Oct 19 at 19:47
6

As others have explained - sudo allows you to temporarily assume administrative privileges (effectively running your command as root). It's still safer than just logging in as root though - as only the commands you prefix with sudo receive this permission (protecting you against accidentally running something with root permissions because you forgot it was a root shell).

For a home desktop environment, it's typical for most users to be given full sudo access, usually via a group ('admin' in the case of Ubuntu, but it can differ by distribution). A production server environment would likely be configured differently.

Strictly speaking, what a user can use sudo to do is controlled via the /etc/sudoers file - which has a bunch of lines like this:

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

There's a lot of scope here to control which commands can be run if desired. Here's a man page that explains the syntax in more detail: https://www.sudo.ws/man/1.8.15/sudoers.man.html

Each line can constrain what commands can be run by a given user or group (and as which users) - so if you wanted to change who could use sudo, or restrict them you have two options:

  • Add or remove them from a group (e.g. Admin) to add or remove the associated sudo privileges.
  • Change the sudo privileges for the associated user or group in /etc/sudoers.

For a home setup, I would suggest being careful about how restrictive / complex you make any rules you setup - you are potentially making a lot more work for yourself later if you get too fancy with it.

| improve this answer | |
  • you are potentially making a lot more work for yourself later - to minimize the worst case, keep a bootable USB stick around with Linux on it, so if you accidentally remove your ability to sudo you can reboot from USB and fix or replace the /etc/sudoers in the root filesystem on your hard driver with a known good copy. – Peter Cordes Oct 19 at 5:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.