5

I was reading the following code:

$ sudo bash
# cd /home/
# ./gitpull.sh

Why do I need the first line, what does it do exactly? What if I just did $ sudo instead of $ sudo bash ?

0

6 Answers 6

9

It starts a bash shell as a root level user. You need it because typically normal users can't access /home/

The danger of what you are doing is you are in a root shell -- you can mess up your machine rather easily.

1
  • 1
    Running cd in a subshell (e.g. via sudo) is not a productive operation... it will not change the directory for the calling shell.
    – FatalError
    Apr 26, 2012 at 19:10
6

You would be much better off doing:

$ sudo sh -c 'cd /home; ./gitpull.sh'

Because the commands invoked as root will be logged. Invoking a shell directly through sudo avoids all of the security benefits of sudo and should be avoided.

4

sudo <shell>, if it works, betrays a poor installation of sudo and a potential security weakness.

sudo should not be configured to allow arbitrary commands like shell; the purpose of sudo is to allow authenticated non-root users to run certain commands as root, without knowing the root password.

If sudo bash is allowed to any user, that user is root simply by virtue of knowing his own password.

If an attacker obtains the password of any one of the accounts which are able to do sudo bash, the attacker thereby has root.

The proper way to do the equivalent of sudo bash (obtain a root shell) is su, followed by giving the root password, not your own.

10
  • I don't get it. What harm could you possibly do with sudo bash (or sudo su, for that matter) that you couldn't do with sudo evil-command?
    – Dennis
    Apr 26, 2012 at 20:33
  • 2
    sudo only allows you to do things specified by the sudoers file. It offers very fine grained control since you could give access to only the programs you want them to have access to. If you allow sudo bash however, you grant a root level shell. You can do anything root can do at a shell. It gets around the advantages of sudo and sudoers and basically makes the user root.
    – Bacon Bits
    Apr 26, 2012 at 20:39
  • 1
    Exactly those harms that you cannot do with sudo benign-command. bash is an instance of the class evil-command. You can craft your sudoers file carefully so that the only commands allowed are those that cannot do any harm (or whose potential to do harm is contained somehow), and which do not allow escalation of privilege over the scope of arbitrary actions.
    – Kaz
    Apr 26, 2012 at 20:40
  • 1
    Allowing 'sudo bash' for user X does not necessarily allow all users in the sudoers file to run bash. Apr 27, 2012 at 4:31
  • 1
    @DavidBetz There is everything wrong with it. The purpose of sudo is to allow certain users to run certain commands as root, without giving them the full privileges (i.e. the root password). The idea is that those commands are sandboxed: they do certain specific jobs, and only those jobs, without allowing privilege escalation. When users are trusted to be root, you give them the root password.
    – Kaz
    Jan 15, 2016 at 19:28
3

The infamous sudo is an acronym of sorts for Superuser Do.

It basically make a normal user a Super user for a short while.

In your command sudo bash , effectively you are saying Superuser do --> a Bourne shell ( bash ) Which opens a root user logged in shell.

If you just ran sudo the operating system wouldn't know what to do. So in general sudo is followed by a unix command.

1

sudo allows users to run programs with the security privileges of another user (normally the superuser, or root).
bash starts a new bash shell.
So, sudo bash starts a new bash shell with the security privilege of root user.

0

I'm betting sudo bash instead of sudo is specified to

  • absolutely ensure you are invoking ./gitpull.sh from bash and not another shell such as tcsh, pdksh or plain old sh. I'm pretty sure the script's hashbang line should allow the script to specify what shell to run it under but maybe it was omitted for some reason or the instruction writer doesn't want you to rely on that.
  • I believe if you start bash without other arguments it doesn't act like a "login shell" and maybe the script depends on that.
  • a force of habit from the person who wrote the instructions (maybe he/she works in a multi-shell environment).
  • perhaps the instruction writer is not very skillful or has bad habits from other environments.

Also @nisdis is right. Plain old sudo just prints usage information. But why not use su...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .