3

I was reading the following code:

$ sudo bash
# cd /home/
# ./gitpull.sh

Why do I need the first line, what does it do exactly? What if I just did $ sudo instead of $ sudo bash ?

migrated from stackoverflow.com Apr 26 '12 at 19:28

This question came from our site for professional and enthusiast programmers.

7

It starts a bash shell as a root level user. You need it because typically normal users can't access /home/

The danger of what you are doing is you are in a root shell -- you can mess up your machine rather easily.

  • Running cd in a subshell (e.g. via sudo) is not a productive operation... it will not change the directory for the calling shell. – FatalError Apr 26 '12 at 19:10
3

You would be much better off doing:

$ sudo sh -c 'cd /home; ./gitpull.sh'

Because the commands invoked as root will be logged. Invoking a shell directly through sudo avoids all of the security benefits of sudo and should be avoided.

1

The infamous sudo is an acronym of sorts for Superuser Do.

It basically make a normal user a Super user for a short while.

In your command sudo bash , effectively you are saying Superuser do --> a Bourne shell ( bash ) Which opens a root user logged in shell.

If you just ran sudo the operating system wouldn't know what to do. So in general sudo is followed by a unix command.

0

sudo allows users to run programs with the security privileges of another user (normally the superuser, or root).
bash starts a new bash shell.
So, sudo bash starts a new bash shell with the security privilege of root user.

0

sudo <shell>, if it works, betrays a poor installation of sudo and a potential security weakness.

sudo should not be configured to allow arbitrary commands like shell; the purpose of sudo is to allow authenticated non-root users to run certain commands as root, without knowing the root password.

If sudo bash is allowed to any user, that user is root simply by virtue of knowing his own password.

If an attacker obtains the password of any one of the accounts which are able to do sudo bash, the attacker thereby has root.

The proper way to do the equivalent of sudo bash (obtain a root shell) is su, followed by giving the root password, not your own.

  • I don't get it. What harm could you possibly do with sudo bash (or sudo su, for that matter) that you couldn't do with sudo evil-command? – Dennis Apr 26 '12 at 20:33
  • sudo only allows you to do things specified by the sudoers file. It offers very fine grained control since you could give access to only the programs you want them to have access to. If you allow sudo bash however, you grant a root level shell. You can do anything root can do at a shell. It gets around the advantages of sudo and sudoers and basically makes the user root. – Bacon Bits Apr 26 '12 at 20:39
  • Exactly those harms that you cannot do with sudo benign-command. bash is an instance of the class evil-command. You can craft your sudoers file carefully so that the only commands allowed are those that cannot do any harm (or whose potential to do harm is contained somehow), and which do not allow escalation of privilege over the scope of arbitrary actions. – Kaz Apr 26 '12 at 20:40
  • 1
    Allowing 'sudo bash' for user X does not necessarily allow all users in the sudoers file to run bash. – William Pursell Apr 27 '12 at 4:31
  • Nothing wrong with sudo bash, buddy. It's a great way to get into a place where you can get your job done quick, and ensure all login scripts ran. – David Betz Jan 15 '16 at 19:16
0

I'm betting sudo bash instead of sudo is specified to

  • absolutely ensure you are invoking ./gitpull.sh from bash and not another shell such as tcsh, pdksh or plain old sh. I'm pretty sure the script's hashbang line should allow the script to specify what shell to run it under but maybe it was omitted for some reason or the instruction writer doesn't want you to rely on that.
  • I believe if you start bash without other arguments it doesn't act like a "login shell" and maybe the script depends on that.
  • a force of habit from the person who wrote the instructions (maybe he/she works in a multi-shell environment).
  • perhaps the instruction writer is not very skillful or has bad habits from other environments.

Also @nisdis is right. Plain old sudo just prints usage information. But why not use su...

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.