4

Context:

sshed into an AWS t1.micro instance running Amazon Linux 2013.09, using the default ec2-user. I'm trying to list the contents of the default postgresql directory:

What's in there?

$ ls /var/lib/pgsql9/

ls: cannot open directory /var/lib/pgsql9/: Permission denied

Ok. Who owns this?

$ ls -l /var/lib | grep pgsql
drwx------ 4 postgres postgres 4096 Jun 22 16:06 pgsql9

Ah. Silly me.

$ sudo -u postgres ls /var/lib/pgsql9/

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for ec2-user:

... What? ec2-user has a password? Time for a bigger gun.

$ sudo sudo -u postgres ls /var/lib/pgsql9/
backups  data

Success! Now, off to superuser.com to figure out what happened.

Why does sudo sudo behave differently than sudo?

2
  • 3
    You know, sudo ls /var/lib/pgsql9 would work too. root can access stuff even if it's not in the permissions
    – Nathan C
    Jun 23, 2014 at 16:25
  • Thanks! I feel pretty silly for not trying that.
    – kdbanman
    Jun 23, 2014 at 16:34

1 Answer 1

6

Amazon EC2 is built like Ubuntu: no root access and everything is done with sudo instead.

What your sudo command did was try to impersonate postgres, requiring permission to do so. ec2-user does not have this permission, so sudo will ask for a password (which will fail because it doesn't have one).

When you did sudo sudo, you are invoking the second sudo as root which has the permissions to impersonate other users, so the command works. Because of the way sudo is configured (the NOPASSWD line in sudoers) it doesn't need a password to execute as root.

3
  • I had to read that a couple of times. So, [email protected] $ sudo <command> executes the <command> as root, and the sudo command sees myuser as the executor of sudo. Chaining them as [email protected] $ sudo sudo ... means that the inner sudo sees root as the executor, who has permission to impersonate any user. Am I correct?
    – kdbanman
    Jun 23, 2014 at 16:52
  • That is correct.
    – Nathan C
    Jun 23, 2014 at 16:57
  • this saved my day.
    – Soorena
    Aug 27, 2018 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .