Linux Labs
Linux Labs
EN

Users, permissions, and processes / Stage 8 of 13

Delegating commands with sudo

Not running Starting usually ~20 s
Leave the lesson

Step 1 of 8 · on a machine · 6 min

Two lines yes, three no

What you will learn

  • Read a sudoers rule as permission for a specific subject to run a specific command.
  • Edit a separate rule with visudo and check the full configuration.
  • Test the allowed action and the refusal beyond it as the target user.

The on-call engineer labops was allowed to view the tail of the log /srv/sudo-lab/status.log through sudo. He writes: "It shows the last two lines, but for three it asks for a password I don't have."

Check it as him. In the card's commands sudo -u labops runs a command as the engineer, and that command is sudo -n itself: this is how labops asks sudo for something without waiting for a password prompt.

Exercise · look

Check the on-call engineer's complaint

As labops, ask sudo for the last two lines of the log, then three, then try to read the log without sudo.

First, predict

labops gets the last two lines. What will he get when he asks for three?

Now start the exercise, run the command and compare your prediction with the output.

Sign in and start The machine is available after signing in
Check yourself 1 question

Why did tail -n 2 go through while sudo demanded a password for tail -n 3?

  • sudo keeps no count of attempts: repeat tail -n 2 and it goes through again.

  • labops never typed a password: the first call went through without one. There was nothing to remember.

  • The number of lines means nothing to file permissions: the log is closed to labops entirely, and cat got Permission denied. The sudo rule decided it.

The rule allows labops exactly tail -n 2 on this log, and sudo lets no other call through without a password.

Found an inaccuracy? Report an error in the lesson

Ubuntu 24.04
Loading…