Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to the man page:

sudoedit /etc/file

creates a copy of the file, opens it as the current user, and when saved overwrites the existing file with the copy.

whereas

sudo vi /etc/file

opens the file as root

The man page states that sudoedit is different from sudo because:

the editor is run with the invoking user's environment unmodified

Is the first method safer, if so why? Are there other reasons for using sudoedit instead of sudo vi?

share|improve this question
up vote 1 down vote accepted

I stumbled upon this question while searching for something completely unrelated, but I thought I would add the following important distinction, which has not been mentionned at all so far: sudoedit doesn't run your editor as root.

$ sudo vim /etc/farts.conf 

Will simply run vim as root, allowing it to read the file. The downside is that the editor now also runs as root and can do anything. If you just wanted to allow a user to edit a config file and nothing else, too bad, you just gave them root on the whole system. Nothing prevents me from spawning a shell from vim with :sh or :!command, and since they're subprocesses, they will also run as root.

On the other hand:

$ sudoedit /etc/farts.conf

will actually operate differently. It will create a copy with a unique name in /tmp with permissions locked down to only your user, and then spawn your editor normally, without root privileges, on that copy.

Once you exit your editor, it will compare the temporary file and original file, and safely replace the original with your edit if it changed.

In this scenario, it becomes possible to allow a user to edit a system file, but not allow them to run random ass binaries as root or poke everywhere on the filesystem.

That is mainly the actual distinction, the rest that has been mentionned is just neat side effects.

share|improve this answer

First of all, sudo vim already explicitly mentions your default editor, which is not necessary if you have it defined in $EDITOR. sudoedit spares you from defining the editor every time you want to edit something—and on a multiuser system it allows everyone to use the editor they personally like.

How so? Consider a system where normal users only get sudo privileges for editing certain files. They are restricted from running sudo with anything else though. You would have to allow them to sudo vi and sudo vim and sudo nano and sudo emacs and sudo pico (et cetera). Instead of having to do that, you could simply allow them to sudoedit the file, with their choice of setting $EDITOR to whatever they like. (Imagine you'd force an Emacs lover to use Vim…)

Another issue is that if your $EDITOR is set to vim, and you have customization settings for it in your user's .vimrc, those settings will not be used if you use sudo vim or sudo $EDITOR. sudoedit however preserves the calling user's environment, and therefore your settings.

See also: What's so great about sudoedit?

share|improve this answer
    
Also the user should be using visudo instead of sudoedit. – Evan Darwin Jul 19 '14 at 17:01
1  
@EvanDarwin No, that is unrelated. visudo is only used to edit the /etc/sudoers file in a safe manner (to prevent you from locking yourself out). sudoedit is a command to edit any file. – slhck Jul 19 '14 at 17:21
    
I'm aware, for some reason my brain saw a "/etc/sudoers" in his question somewhere. Maybe I need some more coffee. – Evan Darwin Jul 19 '14 at 19:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .