I have a fairly long-serving Ubuntu 18.04 LTS desktop computer onto which I have installed a great many apt packages from mainstream and non-mainstream repositories as well as numerous random tarballs built from source over the years.

Recently, shortly (minutes, not seconds) after a new boot & GUI login, I have been seeing a graphical "sudo" prompt asking for privileges for "/bin/sh."

This isn't occurring in response to any particular GUI or terminal process I'm running, so I believe this is a process spun up by either cron or init -- but I don't know what it is, so I am loathe to give it sudo. (If I ignore it or "cancel" it, nothing I care about seems to stop working or fail.)

Since I'm in a multitasking environment here and can open a new window, I've tried looking at "ps" and "htop" to try to figure out what's prompting me for the sudo password, but I can't tell. (Too many processes and no clear indication of which of them are blocking on whatever call that is.)

How can I determine, when I have an open sudo prompt in my Nautilus/Gnome GUI, what particular program is trying to get those perms from me?

  • have a look at /var/log/secure.log and other log in /var/log or while dialog box is active, use ps -H -eaf and try to locate dialog box/sudo process
    – Archemar
    Apr 19, 2023 at 7:42
  • Does something like ps aux | grep -P '[s]udo|[p]kexec' while the dialog is open, before you dismiss it, return anything useful?
    – terdon
    Apr 19, 2023 at 14:11
  • Are you really talking about the exact sudo command, or about something that has a similar goal to sudo (get privileges) but isn't sudo? Because you will confuse people if you're not clear enough. The GUI version could be managed by polkit or many other things. As everything transits through systemd messages, chances are there won't be a clear parent to find, and logs will be needed.
    – A.B
    Apr 19, 2023 at 18:48
  • A.B. -- very good point, I am not sure it's the sudo binary being executed, but rather some kind of privilege management system call. (I had done some trivial steps like looking through the ps output for an actual blocking sudo command.)
    – rvse2003
    Apr 20, 2023 at 6:45
  • Archemar, thank you, I will try to reproduce at next reboot. Terdon, I had previously tried looking for sudo, but did not know to look for kexec, that too is helpful.
    – rvse2003
    Apr 20, 2023 at 6:46

1 Answer 1


If you have systemd on Ubuntu 18 LTS, you may be able to get some info from journalctl

nuc98 ~ # journalctl |grep sudo
Apr 19 13:50:28 nuc98.lan sudo[3090585]:     core : TTY=pts/0 ; PWD=/home/core ; USER=root ; COMMAND=/usr/bin/su -
Apr 19 13:50:28 nuc98.lan sudo[3090585]: pam_unix(sudo:session): session opened for user root(uid=0) by core(uid=500)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .