Команда sudo: повышение привилегий в Unix-системах.

Command on Unix systems to temporarily assume root privileges

Unlike the similar command su, users must, by default, supply their own password for authentication, rather than the password of the target user. After authentication, and if the configuration file (typically /etc/sudoers) permits the user access, the system invokes the requested command. The configuration file offers detailed access permissions, including enabling commands only from the invoking terminal; requiring a password per user or group; requiring re entry of a password every time or never requiring a password at all for a particular command line. It can also be configured to permit passing arguments or multiple commands.

Robert Coggeshall and Cliff Spencer wrote the original subsystem around 1980 at the Department of Computer Science at SUNY/Buffalo.

Unlike the command su, users supply their personal password to sudo (if necessary) rather than that of the superuser or other account. This allows authorized users to exercise altered privileges without compromising the secrecy of the other account's password. Users must be in a certain group to use the sudo command, typically either the wheel group or the sudo group. After authentication, and if the configuration file permits the user access, the system invokes the requested command. sudo retains the user's invocation rights through a grace period (typically 5 minutes) per pseudo terminal, allowing the user to execute several successive commands as the requested user without having to provide a password again. As a security and auditing feature, sudo may be configured to log each command run. When a user attempts to invoke sudo without being listed in the configuration file, an exception indication is presented to the user indicating that the attempt has been recorded. If configured, the root user will be alerted via mail. By default, an entry is recorded in the system.

The /etc/sudoers file contains a list of users or user groups with permission to execute a subset of commands while having the privileges of the root user or another specified user. The file must be edited by using the command sudo visudo. Sudo contains several configuration options such as allowing commands to be run as sudo without a password, changing which users can use sudo, and changing the message displayed upon entering an incorrect password. Sudo features an easter egg that can be enabled from the configuration file that will display an insult every time an incorrect password is entered.

In some system distributions, sudo has largely supplanted the default use of a distinct superuser login for administrative tasks, most notably in some Linux distributions as well as Apple's macOS.

visudo is a command line utility that allows editing the sudo configuration file in a fail safe manner. It prevents multiple simultaneous edits with locks and performs sanity and syntax checks. Sudoedit is a program that symlinks to the sudo binary. When sudo is run via its sudoedit alias, sudo behaves as if the e flag has been passed and allows users to edit files that require additional privileges to write to. Microsoft released its own version of sudo for Windows in February 2024. It functions similar to its Unix counterpart by giving the ability to run elevated commands from an unelevated console session. The program runas provides comparable functionality in Windows, but it cannot pass current directories, environment variables or long command lines to the child. And while it supports running the child as another user, it does not support simple elevation. Hamilton C shell also includes true su and sudo for Windows that can pass all of that state information and start the child either elevated or as another user (or both). Graphical user interfaces exist for sudo – notably gksudo – but are deprecated in Debian and no longer included in Ubuntu. Other user interfaces are not directly built on sudo, but provide similar temporary privilege elevation for administrative purposes, such as pkexec in Unix like operating systems, User Account Control in Microsoft Windows and Mac OS X Authorization Services. gosu is a tool similar to sudo that is popular in containers where the terminal may not be fully functional or where there are undesirable effects from running sudo in a containerized environment.