5

I am new to Linux, so bear with me for my lack of understanding.

Imagine there are 2 users in my Linux installation, say A and B.

User A creates a folder FolderA and adds some files inside this folder. User A then uses the chmod command to block the folder for access by anyone else using the following command

sudo chmod 700 FolderA -R

What I don't understand is how User B can just log into his account and change this restriction using the command as follows.

sudo chmod 777 FolderA -R

I mean what's the point in setting restrictions to a folder when anyone can change it? I just don't understand the logic of this.

Once again, I am new to Linux and hence this question.

Improve this question
2
  • 21
    Not anyone can do ‘sudo’. Only designated users can issue this command. Read about admin privileges in linux.
    – dingalapadum
    Oct 18, 2020 at 22:27
  • 4
    Mandatory XKCD: xkcd.com/838
    – Bernhard Döbler
    Oct 19, 2020 at 16:05

3 Answers 3

Reset to default
32

The sudo command gives temporary adminstrator privileges to a user. If you use this then you bypass any security controls. On a managed multiuser system very few users would have this right - typically just the system administrators. On a home system it's probably that you would have this by default so that you can look after your own system.

Remove FolderA entirely. Then try the commands again without using sudo and see what happens

Improve this answer
9
  • 8
    @LinuxMantri whoever created the user accounts gave them rights to use sudo
    – Chris Davies
    Oct 17, 2020 at 20:35
  • 25
    This is a great example of why slapping sudo in front of every command is a bad idea.
    – Criggie
    Oct 17, 2020 at 21:31
  • 6
    LinuxMantri - Generally there will be a group (probably 'admin', but depends on the distro) that is used to allow access to sudo. Remove the user from that group and they will no longer be able to use sudo. Alternatively, look into the syntax of the /etc/sudoers file if you want to allow some users to use only a limited subset of commands with sudo. That will enable much more fine grained control if that is what you need.
    – Adam Luchjenbroers
    Oct 18, 2020 at 1:19
  • 4
    @DavidZ it depends on the distribution and or Linux/UNIX flavour
    – Chris Davies
    Oct 18, 2020 at 10:45
  • 8
    On the Linux distributions I use regularly the group is called sudo. BSD derived systems often prefer wheel. Personally I've not come across one using admin but without knowing the OP's environment none of this is really helpful to them. (If they come back and ask how to create a user without default root sudo rights we can then ask what distribution or platform they're using, and how they're creating a user account, and then tailor the response accordingly.)
    – Chris Davies
    Oct 18, 2020 at 10:52
12

Using sudo from a user account means that you are no longer operating as that user, but as the super user. As far as the system is concerned, userA and userB have the same privileges - they are both the super user, in other words.

If you wish to limit the privileges of one user under sudo, you can do that in the sudoers file via the command sudo visudo. Note that the sudoers file must be opened for editing in this way.

# This file MUST be edited with the 'visudo' command as root.

Improve this answer
1
  • 2
    If you want to use, say, Emacs to edit your sudoers file, use sudo EDITOR=emacs visudo.
    – A. R.
    Oct 19, 2020 at 19:47
6

As others have explained - sudo allows you to temporarily assume administrative privileges (effectively running your command as root). It's still safer than just logging in as root though - as only the commands you prefix with sudo receive this permission (protecting you against accidentally running something with root permissions because you forgot it was a root shell).

For a home desktop environment, it's typical for most users to be given full sudo access, usually via a group ('admin' in the case of Ubuntu, but it can differ by distribution). A production server environment would likely be configured differently.

Strictly speaking, what a user can use sudo to do is controlled via the /etc/sudoers file - which has a bunch of lines like this:

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

There's a lot of scope here to control which commands can be run if desired. Here's a man page that explains the syntax in more detail: https://www.sudo.ws/man/1.8.15/sudoers.man.html

Each line can constrain what commands can be run by a given user or group (and as which users) - so if you wanted to change who could use sudo, or restrict them you have two options:

  • Add or remove them from a group (e.g. Admin) to add or remove the associated sudo privileges.
  • Change the sudo privileges for the associated user or group in /etc/sudoers.

For a home setup, I would suggest being careful about how restrictive / complex you make any rules you setup - you are potentially making a lot more work for yourself later if you get too fancy with it.

Improve this answer
1
  • you are potentially making a lot more work for yourself later - to minimize the worst case, keep a bootable USB stick around with Linux on it, so if you accidentally remove your ability to sudo you can reboot from USB and fix or replace the /etc/sudoers in the root filesystem on your hard driver with a known good copy.
    – Peter Cordes
    Oct 19, 2020 at 5:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .