Is there a key difference between sudo -e and sudo vim. I have set up the sudoers file so that vim is my default editor. Is there a key difference between the two?
Plus, should I switch from vim to rvim? I tried it but I had some problems with my config file
Add a comment
|
2 Answers
The big difference is who is editing what file.
With sudo vim (assuming successful authentication), the root user invokes vim and edits the file in place (with root's environment and vim swap files parallel to the file being edited).
With sudo -e or sudoedit the user who invoked sudo edits a temporary copy of the file owned by themselves with their own environment (including things like ~/.vimrc). Once the user saves the output, the content of the temporary file is copied back into the original file that the user didn't have the permissions to edit. This method also has a couple checks that prevent editing under a few circumstances:
- the user is trying to edit a symbolic link
- the user is trying to edit a file using a path containing a symbolic link
- the user has write permissions on the directory containing the file
Why those specific rules are strictly enforced, I do not know (some sort of security issues I'd assume).
P.S. Users are also disallowed with sudo's edit mode from editing files that are device special files (block devices, serial devices, etc.).
EDIT: Another consequence of not running vim as root, is that the user cannot use vim's shell capabilities this way to run arbitrary commands as root. This allows giving the user access to edit certain files via sudoers rules, while not handing over the keys to the kingdom.
-
2Should 3 be inversed? Presumably you are prevented from editing if you do NOT have write permissions to the directory, right? Not if you do?– terdon ♦Aug 9, 2022 at 16:57
-
2#3 is straight from the man page of sudo, and I verified it on a CentOS 9 Stream VM. I'm not sure what the rationale is.– t0w0i7neAug 9, 2022 at 17:22
-
That's... strange but you're absolutely right. Confirmed on an Arch Linux box too. I was sure it was just a typo, but no. How weird. Thanks for checking!– terdon ♦Aug 9, 2022 at 17:26
-
4@terdon unix.stackexchange.com/questions/356142/… leads to bugzilla.sudo.ws/show_bug.cgi?id=707.– muruAug 10, 2022 at 2:51
-
1@muru Thanks for the research! That makes a ton of sense now, but is obscure without context. This information (or at least links to the bug reports, or an extended page) would probably be a good addition to the man page.– t0w0i7neAug 10, 2022 at 15:20
There’s one key difference: with sudo -e, the editor runs as your user, not as root; with sudo vim, the editor runs as root. This has a number of consequences; one of them is that with sudo -e, you’ll get your own editor setup; another is that with sudo -e, you won’t risk making other changes to root-owned files. sudo -e also prevents users from running anything else as root (since most editors can start shells).
Basically, with sudo -e, you have a small set of operations done as root (with a number of checks to avoid root escapes), and everything the user interacts with to actually edit the file runs as the user. With sudo vim, everything happens as root, and the user can effectively do anything they want as root.
See also How to properly edit system files (as root) in GUI (and CLI) in Gnu/Linux?
answered Aug 9, 2022 at 16:42
-
1With regards to security, Vim lets you drop to a shell, so if you allow a user to run Vim as root, you might as well give them root privileges. Aug 10, 2022 at 16:02
-
I suspec the why here might be the important part. Given the ability to limit what users can use sudo for, "sudo -e" is much less prone to privilege escalation. Aug 10, 2022 at 16:19