138

I recently got into trouble because of this.

$sudo vim /etc/motd 
[sudo] password for bruce: 
bruce is not in the sudoers file.  This incident will be reported.

Is there a way to check if I have sudo access or not?

3

13 Answers 13

164

Run sudo -v. It is usually used to extend your sudo password timeout, but can be used for determining whether you have any sudo privileges.

$ sudo -v
Sorry, user [username] may not run sudo on [hostname].

Man page excerpt:

If given the -v (validate) option, sudo will update the user’s time stamp, prompting for the user’s password if necessary. This extends the sudo timeout for another 5 minutes (or whatever the timeout is set to in sudoers) but does not run a command.

If your user is only allowed to run specific commands, this command will work, indicating you are allowed to run something with different privileges. While the message looks different when trying to execute a command you're not allowed to in this case (and no mail is sent to root), it's still possible you'll get into trouble if the admins read /var/log/secure.

$ sudo ls
[sudo] password for [username]: 
Sorry, user [username] is not allowed to execute '/bin/ls' as root on [hostname].

To find out what you're allowed to run with different privileges, you can use sudo -l. Note that this command requires you to enter your password.

6
  • 3
    Thanks. sudo -v works for me. The man page says I can run sudo -l as well but that asks for a password. Why is that?
    – Bruce
    Feb 18, 2013 at 20:00
  • 2
    @Bruce I'm guessing here, but otherwise someone (or a program you run) could find out what programs can be executed (possibly without entering password) by your current user and try to use that information maliciously.
    – Daniel Beck
    Feb 18, 2013 at 20:05
  • What do you suppose it means when I get this back: patrick@<host>:~$ sudo -v sudo: unable to resolve host <host>? I entered my password and didn't get anything about unauthorized. I know I have sudo from successfully running other commands, but that unable to resolve host message has me concerned something else might be funky on the host.
    – Patrick M
    Apr 21, 2014 at 3:04
  • @PatrickM It looks like a problem with the sudoers file. In there you can specify on which host a user is authorized to run a specific command (this is useful when using the same sudoers file on multiple machines). Possibly the hostname specified in that file could not be resolved. Try checking it with the host command for example.
    – Ale
    Dec 17, 2014 at 23:10
  • Doesn't work for me on RHEL 6, sudo -v gave "xx is not in the sudoers file. This incident will be reported."
    – 79E09796
    Sep 1, 2016 at 17:03
59

This is very simple. Run sudo -l. This will list any sudo privileges you have.

5
  • 1
    Maybe downvoted because it repeats what Daniel Beck said nearly two years ago. Dec 18, 2014 at 4:09
  • 1
    Or explains what happen, it's a comment, at best
    – Ramhound
    Dec 18, 2014 at 20:47
  • 2
    @Jonathan: if u would script in ubuntu rigt now, sudo -l asks for a password if u can sudo or not. sudo -v asks only if u can, and "$(whoami)" != "root" will never ask anything in any linux.
    – bksunday
    Aug 3, 2015 at 3:37
  • @bksunday You are correct. I tested now on a clean Debian Jessy and confirmed your results. My previous (deleted now) comment was probably a result of testing on a machine on which I had some sudo privs. Aug 3, 2015 at 4:30
  • 2
    @G-Man but this simple answer helped me more than probably more precise Daniel's answer, where this command is the the very end unfortunatelly...
    – Betlista
    Jan 4, 2016 at 14:48
20

Gerald Schade's answer here, can still be improved!

Use

prompt=$(sudo -nv 2>&1)
if [ $? -eq 0 ]; then
  # exit code of sudo-command is 0
  echo "has_sudo__pass_set"
elif echo $prompt | grep -q '^sudo:'; then
  echo "has_sudo__needs_pass"
else
  echo "no_sudo"
fi

Here's a complete example of usage in a script:

#!/usr/bin/env bash

is_root () {
    return $(id -u)
}

has_sudo() {
    local prompt

    prompt=$(sudo -nv 2>&1)
    if [ $? -eq 0 ]; then
    echo "has_sudo__pass_set"
    elif echo $prompt | grep -q '^sudo:'; then
    echo "has_sudo__needs_pass"
    else
    echo "no_sudo"
    fi
}

elevate_cmd () {
    local cmd=$@

    HAS_SUDO=$(has_sudo)

    case "$HAS_SUDO" in
    has_sudo__pass_set)
        sudo $cmd
        ;;
    has_sudo__needs_pass)
        echo "Please supply sudo password for the following command: sudo $cmd"
        sudo $cmd
        ;;
    *)
        echo "Please supply root password for the following command: su -c \"$cmd\""
        su -c "$cmd"
        ;;
    esac
}

if is_root; then
    echo "Error: need to call this script as a normal user, not as root!"
    exit 1
fi


elevate_cmd which adduser
0
16

Here is the script-friendly version:

timeout 2 sudo id && echo Access granted || echo Access denied

since it won't stuck on the password input if you do not have the sudo access.

You can also set it in a variable like:

timeout 2 sudo id && sudo="true" || sudo="false"
echo "$sudo"

Note: On macOS, you need to install coreutils, e.g. brew install coreutils.

5
  • Any alternatives for where timeout isn't available by default, e.g. on OS X?
    – Harry
    Jun 1, 2018 at 16:27
  • 1
    You need to install coreutils, e.g. brew install coreutils.
    – kenorb
    Jun 13, 2018 at 15:08
  • 3
    This does not work for me in a script. For unexplained reason the script hangs until I kill it.
    – beruic
    Oct 11, 2018 at 11:04
  • @beruic you can try this (explained in my answer) timeout -s SIGKILL 5s sudo -v && (echo SUDO Access Granted ; exit 0) || (echo SUDO Access Denied ; exit 1)
    – om-ha
    Oct 8, 2020 at 15:17
  • 2
    Please don't do this. sudo has the feature you need built-in: sudo -vn 2> /dev/null && echo you can sudo without password || echo password required or sudo not permitted Apr 12, 2021 at 1:12
5

For me, 'sudo -v' and 'sudo -l' did not work in a script because sometimes interactive (asking me for a password, like mentioned above). 'sudo -n -l' did also not work, it gave the exit code '1' although I have sudo permissions, because of the missing password. But extending the command to:

A=$(sudo -n -v 2>&1);test -z "$A" || echo $A|grep -q asswor

was successful for me for the script. This expression gives 0 if the current user can call 'sudo' and 1 if not.

Explanation:
The additional parameter -n to sudo prevents interactivity.
The output $A of the command 'sudo -n -v 2>&1' may be:
- empty (in this case, sudo can be called by the current user), or:
- a note that the current user is not authorized for sudo, or:
- a question text for the password (in this case, the user is authorized).
("asswor" will fit for an english "password" as well as for a German "Passwort").

1
  • This is the best solution
    – Erez
    Nov 14 at 10:54
2

i've got low rank to vote and comment, but i wanted to upvote Gerald Schade's answer, as i've found that the only way previously, and thought that no1 else knows it - til now :D

btw my solution:

[[ "$(whereis sudo)" == *'/'* && "$(sudo -nv 2>&1)" != 'Sorry, user'* ]]

(from the end of 2015 mwhahaaa)

1
2

This should be enough to tell you if you have root or not:

sudo whoami

If sudo asks for root password, or it does not work, it also means that you don't have root privileges (at least not through sudo).

2
  • The OP would need to be on the sudoers list for this to work which defeats the point of the question.
    – Burgi
    Feb 11, 2020 at 9:59
  • @Burgi The unsaid part of the answer is that if sudo asks for root password, or it does not work, it also means that you don't have root privileges (at least not through sudo). I insert it into the answer.
    – peterh
    Feb 11, 2020 at 11:04
1

"Sudo access" comes in flavors. Two primary flavors: First you, or a group your a member of, needs to be setup for sudo access in the /etc/sudoers file.

Secondly you need to know your password, or you need to have done a sudo command recently. Recently enough that the timeout hasn't expired. (Fun fact: you can make the time out very long in your sudoer's file.)

I often want to test for the second kind of access in the prolog of a script that will need to sudo some steps. When this check fails I can advise the user he needs to enable the 2nd kind of access before running the script.

bash-3.2$ if sudo -S -p '' echo -n < /dev/null 2> /dev/null ; then echo 'Sudo is enabled.' ; else echo 'Sudo is not enabled' ; fi
Sudo is enabled.
bash-3.2$ sudo -K
bash-3.2$ if sudo -S -p '' echo -n < /dev/null 2> /dev/null ; then echo 'Sudo is enabled.' ; else echo 'Sudo is not enabled' ; fi
Sudo is not enabled

The -S tells sudo to read the password from stdin. The -p sets an empty prompt. The -K clears the second time of access.

Since it sends stderr to /dev/null, it will also check if the user has the first type of sudo access.

0
            # Verify if current user is root.
            local current_username=$(whoami)
            [[ "$current_username" == 'root' ]] && echo true && return 0

            # Verify if sudo is installed.
            if [[ $(validate_apt 'sudo') == 'false' ]]; then
                echo false && return 0
            fi

            # Verify if the current user belongs to groups 'sudo' or 'root'.
            local current_user_groups=$(groups $current_username)
            if [[ $current_user_groups == *'root'* ]] ||
                   [[ $current_user_groups == *'sudo'* ]]; then
                echo true && return 0
            fi

            # Verify if file /etc/sudoers.d/username exists.
            if [[ -f /etc/sudoers.d/$current_username ]]; then
                echo true && return 0
            fi
0

I want to check sudo mode for nice script interactivity/error-checking.

I like Kenorb's answer which uses timeout, it didn't work for me though because of the default kill signal. So I edited this bit and sprinkled some additions as explained below.

timeout -s SIGKILL 5s sudo -v && (echo SUDO Access Granted ; exit 0) || (echo SUDO Access Denied ; exit 1)

Explanation:

  • -s SIGKILL specifies SIGKILL as a kill signal. I prefer this over SIGSTOP since it has less clutter in STDOUT. Full list of kill signals can be found here. Also SIGSTOP v.s. SIGKILL

The signals SIGKILL and SIGSTOP cannot be caught, blocked, or ignored.

  • 5s denotes 5 seconds, seconds is the default but you can also use m minutes or h hours. For a reference: DURATION parameter description in man timeout
  • sudo -v for reasons specified in the selected answer
  • exit 0 and exit 1 to represent success and failure exit status codes respectively. Full list of exit status codes can be found here 1, here 2 and here 3
  • ; was used to chain shell commands inline.
  • && and || are just some boolean expressions that uses sudo -v exit code. If you're confused, it's just Boolean/Logical Short Circuit Evaluation
0

The code below returns a sentence that is better understandable for average user:

[ $(fgrep "${USER}" /etc/group | egrep -c ^"(sudo|wheel)\:") -eq 1 ] && echo -e "${USER} has sudo rights" || echo -e "${USER} has not sudo rights"

(or there are Linux Distros with other group names for sudo than sudo and wheel ?)

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Dec 23, 2021 at 13:19
0
sudo -nv 2>/dev/null||sudo -v||exit 64
-5

Follow these steps to view the sudoers file. If you're in there, you have sudo. If not, you can add yourself.

  1. su
  2. visudo
  3. Bottom of the file, enter your_username_here ALL=(ALL) ALL
  4. Hit ESC and type :wq
  5. Type exit
  6. Re-run your command that needed sudo
  7. Enter your password (not the root's password)
2
  • 11
    The OP "got into trouble" for running sudo, so he probably isn't the system administrator, nor even one of the elite system administrators. He's probably just a user who thought he might have been granted some limited powers. What makes you suspect that he can go su? Aug 20, 2014 at 20:46
  • 1
    Respect for this answer poster, he kept this despite the dislikes so others can benefit from its flawed assumption, and the comment above me.
    – om-ha
    Oct 8, 2020 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.