8

The below fails:

sudo -u chris ls /root
ls: cannot open directory '/root': Permission denied

While the below succeeds:

sudo ls /root
...

I do not understand why. I assume -u just changes the $USER/running user to the parameter provided in addition to having root privliges. What is the cause behind this behavior?

1
  • Give it a look even here. There are some additional words and tests about variables and sudo -i, sudo -s, sudo su...
    – Hastur
    Feb 5, 2021 at 9:56

3 Answers 3

23

sudo -u chris runs the given command as user chris, not as root with USER set to chris. So if chris can’t access /root, sudo -u chris won’t change that.

See man sudo:

-u user, --user=user

Run the command as a user other than the default target user (usually root).

sudo isn’t specifically a “run as root” tool; it’s a “run as some other user or group” tool.

8
  • Okay from what I understand from the above, sudo -u chris is just running as chris, rather than running as chris with root privileges? Feb 3, 2021 at 13:08
  • 10
    Yes, sudo doesn’t bestow root privileges; it’s being root that bestows root privileges. Feb 3, 2021 at 13:12
  • 5
    The entire permissions model is based on your user id. There's really no such thing as "me, but with someone else's permissions". (There's a distinction between real and effective user id for a process, but one or the other is used for a particular operation.)
    – chepner
    Feb 3, 2021 at 22:23
  • 3
    @RossPresser the redirection (and the ~) in your sudo -u chris echo 'I hacked you!' > ~/hacked.txt example will be processed by the initial user's shell, not by sudo, and is unlikely to generate a file owned by chris.
    – Jeff Schaller
    Feb 4, 2021 at 12:48
  • 1
    @chepner The baseline UNIX DAC model is, but most systems have additional permissions models built on top of that. On Linux for example, there absolutely is a concept of ‘me, but with admin privileges’ if you leverage capabilities. Feb 4, 2021 at 13:01
2

sudo will run a command as a certain user, defaulting to root. This does not mean that it will always be root, because the -u option selects the user, not root in this case. If you want to become root you can either run a command with sudo (like sudo chown chris:chris ~) or you can use the command su to switch your user to root, then just run exit to go back to your user

2
  • 2
    Of course: Even su may be used to change the user altogether su john
    – FelixJN
    Feb 3, 2021 at 13:24
  • Or you could run su root -c "some command here" to run a single command via su. Or you could run sudo -s or sudo -i to start a regular or login shell interactively. It's not like one only does one thing and the other another thing, sudo just has more configurability and a more granular permission system.
    – ilkkachu
    Feb 4, 2021 at 8:51
-2

sudo:Super User DO It is a way to grant users the rights to execute system commands.

If chris is the host try this

sudo -h chris  ls -l /root

-h, --help display help message and exit

-h, --host=host run command on host (if supported by plugin)

drwxr-xr-x 2 root root 4096 Jan 18 23:52 Desktop
drwxr-xr-x 2 root root 4096 Jan 18 23:52 Documents
drwxr-xr-x 2 root root 4096 Jan 18 23:52 Downloads

              

or you can remove "root"

sudo -u chris  ls -l /

lrwxrwxrwx 1 root root 7 Jan 18 20:32 bin -> usr/bin

From http://www.linfo.org/root_directory.html

"The root directory is the directory on Unix-like operating systems that contains all other directories and files on the system and which is designated by a forward slash ( / ).

The use of the word root in this context derives from the fact that this directory is at the very top of the directory tree diagram""

1
  • Negative vote. Why?
    – kasa
    Feb 5, 2021 at 1:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .