How universal is sudo?

Question

I was writing some instructions on how to install something (TeX-related - if you don't ask, I won't ruin your day by supplying more details) and used sudo to install system-wide. Someone commented that they didn't think that sudo was available on all Linux (or Unix) distributions.

Are there Unix distributions that don't have sudo, and if so what are they? Is there a universally acknowledged "Get me superuser privileges" command that is on all systems?

Warren Young · Answer 1 · 2018-11-01T22:00:35.927

sudo cannot be considered universal:

Red Hat Enterprise Linux: sudo is installed by default on Red Hat Enterprise Linux and its derivatives,¹ but it only installs ready-to-use in RHEL 7 and newer.

Red Hat Enterprise Linux 7 added a new option to the installation screen where you create the first non-root user, a checkbox labeled "Make this user administrator." Its purpose is not documented on that page of the installation guide, but one of its effects is to allow that user to run any command through sudo. It does so by adding that user to the wheel group, which can run any command under the stock sudo package configuration.

Red Hat Enterprise Linux 3 through 6 also installed sudo by default,² but until RHEL 7, it shipped configured such that only root could run commands through it. The easiest way to fix this is to add one or more users to the wheel group, then run visudo as root and uncomment the %wheel ALL=(ALL)... line.
Debian: As of Debian 9, a minimal installation includes sudo.

In Debian 7 and 8, you had to select the "Standard system utilities" package set during installation to get sudo. If you install sudo that way, the OS installer will automatically add the non-administrative user you created earlier in the installation process to the sudo group, which has permission to run all commands.

In Debian 6 and earlier, you had to install sudo via apt-get after installation and configure it by hand to grant non-root users the ability to use it.
FreeBSD: sudo is not installed by default in FreeBSD. You have to build it from Ports.
NetBSD: Same as FreeBSD.
OpenBSD: sudo used to be installed by default in OpenBSD, but they've switched to doas as of 5.8, released in October 2015. doas ships disabled by default.

To get sudo in current versions, you have to install it from the package repository. OpenBSD's sudo package is configured much like in RHEL 3 through 6, so that only root can run commands through it, which rather defeats the purpose of sudo. If you added a non-root user during installation, it was added to the wheel group, so the simplest way to make sudo useful on an OpenBSD system is to uncomment the %wheel ALL=(ALL)... line via visudo.
Solaris: sudo is installed by default in Solaris 11, but Solaris 10 and older use the similar-but-not-quite-the-same pfexec.

You can get sudo for older systems, but defaults matter. Solaris 10 and older will be with us for years, so if you have Solaris in your environment and you're not personally in control of those systems and so can ensure sudo is there, you can't count on it.

The older the system, the greater the chance it doesn't have sudo. Although sudo is very old, it didn't start becoming popular until the mid-2000s. Systems older than that are highly unlikely to have sudo. Unix boxes tend to live a long time, so it is not inconceivable that you would still run across such a system today.

I only count on sudo on systems I personally manage, or ones like Ubuntu, macOS, or openSuSE where it's the only way to get root privileges, by default.

su is closer to a universal "get me superuser privileges" command than sudo, but then you have systems like Ubuntu and macOS where the root account is locked by default specifically to force you to use sudo instead of su. So, you can't call su universal, either.

Footnotes:

CentOS, Oracle Linux, Scientific Linux...
Yes, even in minimal installs.

But what about HP-UX? And SINIX? (To be clear, I want to imply my admiration, not actually ask.) — Volker Siegel, Jan 24 '20 at 21:21

score 9 · Answer 2 · edited Oct 12 '16 at 02:00

9

sudo is a utility that is available on almost all Linux-Systems.
However, it is not bundled by default in all distros. All major distros have it bundled by default though.

Linux Distributions like Arch Linux, Gentoo, LFS, etc. which allow the user complete customisability do not have sudo by default.

On Arch Linux, the base system does not come with sudo installed. The user must manually download sudo and edit the sudoers file.
Ditto for Gentoo and LFS. I don't know of any other major distro without sudo.

And no, I don't think there exists anything that is more universal than sudo in granting super-user privileges. That is, apart from actually logging in as root.

edited Oct 12 '16 at 02:00

Jeff Schaller

66,199
35
114
250

answered Sep 18 '12 at 15:18

darnir

4,429
1
20
33

2

`sudo` might be bundled on most distros, but not all of them configure every user as capable of running it. – jsbillings Sep 18 '12 at 15:23
Another good point. Depends on what the sudoers file says. – darnir Sep 18 '12 at 15:25

score 7 · Answer 3 · answered Sep 19 '12 at 01:13

The most widely-used distribution, Ubuntu, uses sudo as the recommended method to become root (when using the command line — users who stick to the GUI will get a password prompt without understanding or caring about what happens under the hood). Other distributions may or may not encourage having sudo set up and may or may not even ship it. On the other hand, su is available everywhere, and usable on most systems except those where only sudo is available because the user won't have the root password.

Between su and sudo, you will cover almost all your users. The exotic few who need calife or op or pfexec know what to do already. Even if they don't, a system that uses neither su nor sudo is likely to have files in unfamiliar places and enough things you haven't thought of that your instructions probably won't work anyway.

J. M. Becker · Answer 4 · 2012-09-30T17:54:00.923

6

To answer your question, most accurately, no sudo isn't considered universal. Truthfully the entire concept of 'universal', is often a red herring. This is especially true, with regard to cross-distro compatibility. Once your throw in the multitude of differing software versions, universality becomes semi-unrealistic. Scripting by nature is pragmatic, if it was pedantic, writing portable scripts would be practically impossible.

Normally I gauge my intended executing environment, A semi-modern Linux distribution, I expect a POSIX shell with the common GNU Utils. For scripts that could run outside of Linux, I only expect full POSIX standard. Obviously many scripts are specific to Linux, or specific to distro, so that often narrows the portability scope.

To address your specific scripting case,

#!/bin/sh


## Exit Point
die() {
    [ -n "$2" ] && echo "$2"
    exit $1
}


## Require SuperUser Execution, Otherwise Re-Execute
[ `id -u` -ne 0 ] && {

    command -v lsb_release > /dev/null && {
        DISTRO="`lsb_release -is`"
        [ "$DISTRO" = "Ubuntu" ] && SUPERUSER='sudo'
    }
    SUPERUSER="${SUPERUSER:-su}"

    case "$SUPERUSER" in
        su)
            su -c "$0"
            ;;
        sudo)
            sudo "$0"
            ;;
    esac
}

## Require SuperUser Execution
[ `id -u` -ne 0 ] && die 78




echo 'Script Executed by UID'
id -u




## Clean Up
die 0

that pasted script is POSIX shell compliment, I always write Dash compatible.

edited Sep 30 '12 at 17:54

answered Sep 18 '12 at 16:13

J. M. Becker

4,831
3
28
40

But doesnt your script require that sudo be installed? Is there any way we can gain super-user access without the use of sudo? Through plain scripting? – darnir Sep 18 '12 at 16:54
@darnir: No, the pasted script doesn't require `sudo` to be installed. It requires superuser execution, and can use `sudo` if it's available. If `sudo` isn't available, then the script must be run as the root user, or it will `die`. – J. M. Becker Sep 18 '12 at 16:58
@darnir: Additionally there really is nothing called, "plain scripting". Almost everything, excluding shell built-ins, is done through regular binaries. That's the whole point of the shell, to call other commands, whether interactive or automated. It's this defining characteristic, which separates shell from general purpose programming languages. So regardless of how you acquire superuser, your doing it through external commands..., assuming your not coding with raw kernel interfaces. – J. M. Becker Sep 18 '12 at 17:14
So, please do correct me if I'm wrong here, I'm quite new to shell scripting as such. This script is not capable of privilege escalation per se, is it? I cannot run it as a normal user without installing sudo on my machine. Is there any way to manually emulate what sudo does? Guess, I'll go and check the source for sudo, try to emulate it on my own and try.. – darnir Sep 18 '12 at 17:21
@darnir: yes the process of getting root, when `sudo` isn't installed, is left to the user. I would safely assume a user of this type of distro, would likely have such expertise. `sudo` is written in C-code, so it uses raw kernal interfaces/APIs, and does things which cannot be done in shell. That source, most likely, isn't the place to scour. Your only other option, to script this, is to utilize `su`. `su` is never preferable to `sudo` for this kind of task, but would suffice as a fallback. – J. M. Becker Sep 18 '12 at 17:29
@darnir: I updated the pasted script, it now contains a kludgy `su -c` fallback use if `sudo` is unavailable. This should be a completed example. – J. M. Becker Sep 18 '12 at 17:48
What if a distribution contains sudo, but the users is not in sudoers by default, e.g. Fedora, CentOS? – varesa Sep 24 '12 at 05:15
@varesa: You would get password prompted, and then `sudo` would fail authorization. A user could also fail `su` authorization, as they may lack pam.d requirements. Or even more simply, they may not know the proper passwords. Basically your asking, what would happen when a user fails authorization. This is always a possibility, when attempting to acquire superuser permissions. – J. M. Becker Sep 27 '12 at 14:15
@TechZilla My point was just that all the distributions I have used allow users to su by default. So if it fails, the user has propably changed something. It is not the same with sudo. Usually I try not to make my scripts/programs need user to have done some modifications. Is there any easy way for a script to check if user could use sudo? – varesa Sep 27 '12 at 15:40
1

@varesa: Interestingly Ubuntu is the exact opposite on sudo/su default configurations. You can check what sudo permissions a user has available, by executing `sudo -l`. Unfortunately it's unusable in this situation, as it may require password entry. Thinking about this more carefully, I actually think the whole concept might be best achieved via a per distro test. Using `su -c` unless running a `su` default disabled distro, in which case using `sudo su -c`. As others have mentioned, it's best to leave superuser elevation to the user, I would consider any scrip-around a convenience. – J. M. Becker Sep 30 '12 at 17:17
1

@varesa: I've updated the pasted script, to reduce chance of using an un-configured `sudo`. This should execute properly in most distro's, assuming default `su`/`sudo` configurations. I do know an out-dated Ubuntu, pre `lsb_release`, would need to be addressed... But this really is just an example, and could obviously be extended. – J. M. Becker Sep 30 '12 at 18:00

How universal is sudo?

4 Answers4

Linked