37

In a comment here I've been told that unnecessarily using sudo should be avoided. While it wasn't needed in that particular case, I don't see any harm in using it.

I think that when executing trivial programs like cat as root using sudo, the overall risk of hitting a bug that would somehow compromise system security is very low.

So can someone please point out the possible implications, besides typing 4 more characters and a space?

  • 12
    "Note that if I can get you to "su and say" something just by asking, you have a very serious security problem on your system and you should look into it." (By Paul Vixie, vixie-cron 3.0.1 installation notes) – user26592 Nov 4 '14 at 22:51
  • 8
    Community wiki also says: "You could type a command incorrectly and destroy the system" – Pandya Nov 5 '14 at 1:56
  • 3
    When writing this question I unintentionally forgot to exclude poor consciousness or utter stupidity, sorry for that. Being someone who uses Linux since 14 years, it seemed obvious to me that when executing commands using sudo or as root you have to exercise caution and actually know what you're doing and check what you're typing. I wanted to delete the question, but I recognize that this Q/A helps users with less experience so I'll just let it stand. – Jan Nov 5 '14 at 10:29
  • 20
    Obligatory xkcd reference. – leftaroundabout Nov 5 '14 at 14:30
  • 5
    sudo rm -rf /<accidental enter> Get the picture? – jpmc26 Nov 5 '14 at 20:57
70

The risk of a typo is more than the risk of a bug.

The risk of gaining a habit of "it doesn't work, stick sudo on it!" is much higher than the risk of a bug.

As a sysadmin who's seen people execute all sorts of random commands with sudo that didn't need them, I always caution against superfluous usage of sudo.

While cat isn't harmful, the habit that this encourages is.

  • 8
    @BenCrowell close (but sudo wouldn't apply on the redirection). – muru Nov 4 '14 at 23:01
  • 13
    The habit of just adding sudo is indeed a very dangerous one. Rather one should stop and ask "why do I need sudo here?" And if you don't know a good reason, chances are you made some other mistake in the command. Just adding whatever it takes to make error messages go away lead you to mistakes like this one: serverfault.com/questions/587102/… (My favorite comment is the one asking "How do you even type --no-preserve-root accidentally?") – kasperd Nov 4 '14 at 23:44
  • 22
    svn update. Eugh conflicts. I know. sudo svn update. I've actually seen this... – Boris the Spider Nov 4 '14 at 23:44
  • 8
    I don't use subversion but I'd guess that using something like sudo svn update would also completely mess up permissions - leaving you in a worse state than you were to start with. – daboross Nov 5 '14 at 4:29
  • 5
    @DaboRoss I think that should be included in @muru's answer, because this is one of the pitfalls of using sudo: you might end up creating files that are only accessible by invoking sudo again. – Sanchises Nov 5 '14 at 12:23
15

I think there is another issue not yet mentioned: sudo status is cached for the shell with a default of 15 minutes. This means you don't have to provide your password in the next 15 minutes in order to execute a potentially dangerous command.

I think we all can think of more or less likely security issues that could result from that: Unknown software bugs that exploit this or forgetting to lock the screen with random people or co-workers around come to mind.

This is indeed my primary reason for not using sudo when I don't have to and even if I have to, for frequently closing shells after I'm done with sudo work.

  • 1
    That risk can be mitigated by using the tty_tickets option in sudoers and sudo --remove-timestamp. – Martin Schröder Nov 6 '14 at 11:15
  • 1
    @MartinSchröder I already took tty_tickets into account. But you can set timestamp_timeout. That's why I wrote "default". I'm sure the majority of users will never change any of those options but of course that's speculation on my part. – musiKk Nov 6 '14 at 11:20
9

Using sudo excessively is the Linux equivalent of the old Windows habit of running everything under the Administrator account. That one has been discussed and criticized to hell and back, so you can read everything that talks about why a person should not be running their Windows computer as an Administrator, and every single point will apply to habitual use of sudo on Linux.

4

well, it's just cause you might accidentally mess with sensitive parts of your file system, causing much much trouble to yourself Being careful is never enough, so better not to expose yourself to unnecessary dangers

-1

When you do anything with Sudo, it means you give full rights to it, that's root access which is sometimes become very risky, if inadvertently, an app, which is running with root permission could do something wrong, results in a system crash to the corruption of the OS. Anyhow, for Cat, it's fine with root.

  • sudo can be configured to provide limited access. By default it provides an equivalent of full root access, but isn't required. – flickerfly Nov 11 '14 at 21:36
-1

There is nothing wrong with unnecessarily using Sudo. Sudo (in it's default configuration/purpose on Ubuntu) provides fully elevated privilidges. If a user has been granted those privilidges, they are his to exercise as he wishes (including unnecessarily!). However, using Sudo when it isn't needed raises the stakes. It's an unnecessary risk. A simple typo can become disasterous, and that is why most people avoid using elevated permissions when they aren't needed. However, just because it is common practice to avoid unnecessary Sudo usage, doesn't mean it's wrong to go a different way. Sudo to your heart's content!

Within the context of AskUbuntu, I'm not at all surprised that you were instructed to avoid unnecessary Sudo usage. The purpose of this site is to allow experts to ask questions and get expert responses, but in reality there are lots of novice users on here, who know just enough to get themselves into trouble. It's common for posters to try and protect these users from themselves. Sudo abuse is common among novice users, because they don't really understand what is or does, nore take the time to learn. Also, this site prides itself on producing quality content. Unnecessary commands are inefficient, and therefore reduce the quality of a post.

  • 1
    Bad advice: use sudo very carefully! If you need sudo privileges it usually means you are doing something dangerous... – Fabby Mar 28 '16 at 20:44
  • 2
    @Fabby OP isn't suggesting one use Sudo unsafely, but rather pointing out that unnecessary usage doesn't equate to unsafe usage. – Hypno Toad Mar 28 '16 at 22:09
  • 2
    @Rinzwind There is nothing wrong with using a missle to kill an ant, so long as you're careful not to blow anything else up in the process. Unnecessary isn't a synonym for unsafe. – Hypno Toad Mar 28 '16 at 22:10
  • 1
    Yes there is. Example #1 askubuntu.com/questions/751339/… – Rinzwind Mar 29 '16 at 7:16
  • 2
    @HypnoToad While I personally avoid using Sudo if I don't need root permissions, and encourage others to do the same, you are correct. Unnecessary and unsafe are not the same thing. There is nothing wrong with using Sudo for every task you do, so long as you use it safely. But as said, I wouldn't suggest anyone do this, because it puts your system at unnecessary risk. – Dean Z Mar 29 '16 at 17:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.