From the sudo manpage:
sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy.
That does not affect the regular (file system) permissions. So, if an executable has permissions 755 (-rwxr-xr-x
) every user on the system can execute it. But -- depending on the executable -- for some operations you get a permission denied error:
$ ls -l /sbin/ifconfig
-rwxr-xr-x 1 root root 67912 May 11 2013 /sbin/ifconfig
$ whoami
user
$ /sbin/ifconfig
eth0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:29886 errors:0 dropped:0 overruns:0 frame:0
TX packets:17383 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3706932 (3.5 MiB) TX bytes:34965406 (33.3 MiB)
$ /sbin/ifconfig eth0 down
SIOCSIFFLAGS: Operation not permitted
$ sudo /sbin/ifconfig eth0 down
[sudo] password for user:
- no error -
$
Please note that changing the permissions of /sbin/ifconfig
to 700 (-rwx-----
) will prevent normal users to execute it, but there might be others means to gain the information. E. g. the IP address via ip address
or the /proc
file system.
ifconfig
, but cannot make modifications likeifconfig eth0 down
which requires root/sudo.sudo command
. Otherwise only the file system permissions (or other security mechanisms) are obeyed.sudo /sbin/ifconfig (...)
is to run the/sbin/ifconfig
command as userroot
, who can do more with that command than a regular user can, not because of the permissions set on/sbin/ifconfig
or because of the lines in thesudo
configuration, but because of permissions set on other files that are used by/sbin/ifconfig
.