I was reading the following code:
$ sudo bash
# cd /home/
# ./gitpull.sh
Why do I need the first line, what does it do exactly? What if I just did $ sudo
instead of $ sudo bash
?
It starts a bash shell as a root
level user. You need it because typically normal users can't access /home/
The danger of what you are doing is you are in a root shell -- you can mess up your machine rather easily.
cd
in a subshell (e.g. via sudo
) is not a productive operation... it will not change the directory for the calling shell.
Apr 26, 2012 at 19:10
You would be much better off doing:
$ sudo sh -c 'cd /home; ./gitpull.sh'
Because the commands invoked as root will be logged. Invoking a shell directly through sudo avoids all of the security benefits of sudo and should be avoided.
sudo <shell>
, if it works, betrays a poor installation of sudo and a potential security weakness.
sudo
should not be configured to allow arbitrary commands like shell; the purpose of sudo
is to allow authenticated non-root users to run certain commands as root, without knowing the root password.
If sudo bash
is allowed to any user, that user is root simply by virtue of knowing his own password.
If an attacker obtains the password of any one of the accounts which are able to do sudo bash
, the attacker thereby has root.
The proper way to do the equivalent of sudo bash
(obtain a root shell) is su
, followed by giving the root password, not your own.
sudo bash
(or sudo su
, for that matter) that you couldn't do with sudo evil-command
?
sudo
only allows you to do things specified by the sudoers
file. It offers very fine grained control since you could give access to only the programs you want them to have access to. If you allow sudo bash
however, you grant a root level shell. You can do anything root can do at a shell. It gets around the advantages of sudo
and sudoers
and basically makes the user root.
Apr 26, 2012 at 20:39
sudo benign-command
. bash
is an instance of the class evil-command
. You can craft your sudoers
file carefully so that the only commands allowed are those that cannot do any harm (or whose potential to do harm is contained somehow), and which do not allow escalation of privilege over the scope of arbitrary actions.
sudo
is to allow certain users to run certain commands as root, without giving them the full privileges (i.e. the root password). The idea is that those commands are sandboxed: they do certain specific jobs, and only those jobs, without allowing privilege escalation. When users are trusted to be root, you give them the root password.
The infamous sudo is an acronym of sorts for Superuser Do.
It basically make a normal user a Super user for a short while.
In your command sudo bash , effectively you are saying Superuser do --> a Bourne shell ( bash ) Which opens a root user logged in shell.
If you just ran sudo the operating system wouldn't know what to do. So in general sudo is followed by a unix command.
sudo
allows users to run programs with the security privileges of another user (normally the superuser, or root).
bash
starts a new bash shell.
So, sudo bash
starts a new bash shell with the security privilege of root user.
I'm betting sudo bash
instead of sudo
is specified to
./gitpull.sh
from bash and not another shell such as tcsh
, pdksh
or plain old sh
. I'm pretty sure the script's hashbang line should allow the script to specify what shell to run it under but maybe it was omitted for some reason or the instruction writer doesn't want you to rely on that.bash
without other arguments it doesn't act like a "login shell" and maybe the script depends on that.Also @nisdis is right. Plain old sudo
just prints usage information. But why not use su
...