7

The below fails:

sudo -u chris ls /root
ls: cannot open directory '/root': Permission denied

While the below succeeds:

sudo ls /root
...

I do not understand why. I assume -u just changes the $USER/running user to the parameter provided in addition to having root privliges. What is the cause behind this behavior?

1
  • Give it a look even here. There are some additional words and tests about variables and sudo -i, sudo -s, sudo su...
    – Hastur
    Feb 5 at 9:56
23

sudo -u chris runs the given command as user chris, not as root with USER set to chris. So if chris can’t access /root, sudo -u chris won’t change that.

See man sudo:

-u user, --user=user

Run the command as a user other than the default target user (usually root).

sudo isn’t specifically a “run as root” tool; it’s a “run as some other user or group” tool.

8
  • Okay from what I understand from the above, sudo -u chris is just running as chris, rather than running as chris with root privileges? Feb 3 at 13:08
  • 10
    Yes, sudo doesn’t bestow root privileges; it’s being root that bestows root privileges. Feb 3 at 13:12
  • 5
    The entire permissions model is based on your user id. There's really no such thing as "me, but with someone else's permissions". (There's a distinction between real and effective user id for a process, but one or the other is used for a particular operation.)
    – chepner
    Feb 3 at 22:23
  • 3
    @RossPresser the redirection (and the ~) in your sudo -u chris echo 'I hacked you!' > ~/hacked.txt example will be processed by the initial user's shell, not by sudo, and is unlikely to generate a file owned by chris.
    – Jeff Schaller
    Feb 4 at 12:48
  • 1
    @chepner The baseline UNIX DAC model is, but most systems have additional permissions models built on top of that. On Linux for example, there absolutely is a concept of ‘me, but with admin privileges’ if you leverage capabilities. Feb 4 at 13:01
1

sudo will run a command as a certain user, defaulting to root. This does not mean that it will always be root, because the -u option selects the user, not root in this case. If you want to become root you can either run a command with sudo (like sudo chown chris:chris ~) or you can use the command su to switch your user to root, then just run exit to go back to your user

2
  • 2
    Of course: Even su may be used to change the user altogether su john
    – FelixJN
    Feb 3 at 13:24
  • Or you could run su root -c "some command here" to run a single command via su. Or you could run sudo -s or sudo -i to start a regular or login shell interactively. It's not like one only does one thing and the other another thing, sudo just has more configurability and a more granular permission system.
    – ilkkachu
    Feb 4 at 8:51
-2

sudo:Super User DO It is a way to grant users the rights to execute system commands.

If chris is the host try this

sudo -h chris  ls -l /root

-h, --help display help message and exit

-h, --host=host run command on host (if supported by plugin)

drwxr-xr-x 2 root root 4096 Jan 18 23:52 Desktop
drwxr-xr-x 2 root root 4096 Jan 18 23:52 Documents
drwxr-xr-x 2 root root 4096 Jan 18 23:52 Downloads

              

or you can remove "root"

sudo -u chris  ls -l /

lrwxrwxrwx 1 root root 7 Jan 18 20:32 bin -> usr/bin

From http://www.linfo.org/root_directory.html

"The root directory is the directory on Unix-like operating systems that contains all other directories and files on the system and which is designated by a forward slash ( / ).

The use of the word root in this context derives from the fact that this directory is at the very top of the directory tree diagram""

1
  • Negative vote. Why?
    – kasa
    Feb 5 at 1:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.