4.1.1. Privilege Escalation: sudo, su, and Polkit

💡 First Principle: The principle of least privilege says every process should run with the minimum permissions needed to do its job. sudo implements this by granting specific elevated commands to specific users — instead of handing out the root password, you grant alice ALL=(ALL) /usr/bin/systemctl and she can manage services without any other root capability.

sudo Configuration:

visudo                          # Edit /etc/sudoers safely (checks syntax before saving)
# Never edit /etc/sudoers directly — a syntax error locks you out

# /etc/sudoers format:
# user  host=(run-as)  command
alice   ALL=(ALL)       ALL                    # Full sudo (not recommended)
bob     ALL=(ALL)       /usr/bin/systemctl     # Only systemctl
carol   ALL=(ALL)       NOPASSWD: /usr/bin/apt # No password prompt

# Aliases
User_Alias  ADMINS = alice, bob
Cmnd_Alias  SERVICES = /usr/bin/systemctl, /usr/sbin/service
ADMINS      ALL=(ALL)   SERVICES

# Drop-in files (preferred — survives package updates)
# /etc/sudoers.d/alice
alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx

# Key options
# NOPASSWD: — run without password (use sparingly)
# NOEXEC:   — prevent spawning subshells/editors that could escape restrictions

sudo command                    # Run as root
sudo -u postgres psql           # Run as specific user (postgres)
sudo -i                         # Interactive root shell (full root environment)
sudo -l                         # List what the current user can sudo
sudo !!                         # Re-run last command with sudo

su — Switch User:

su -                            # Switch to root (full login environment)
su - alice                      # Switch to alice (login environment)
su alice                        # Switch to alice (current environment — less safe)

The - flag is critical: su - gives you the target user's full login environment (PATH, HOME, etc.). Without -, you inherit the current environment, which can cause unexpected behavior when scripts rely on environment variables.

Wheel and sudo Groups:

# RHEL/Fedora — wheel group has sudo access
usermod -aG wheel alice

# Debian/Ubuntu — sudo group has sudo access
usermod -aG sudo alice

Polkit (PolicyKit): Manages privilege escalation for graphical applications and D-Bus services. Where sudo is for CLI, Polkit is for GUI actions (mounting drives, changing network settings). Polkit rules live in /etc/polkit-1/rules.d/ and can grant specific actions to specific groups without full sudo.

⚠️ Exam Trap: sudo -i gives a full root login shell — it sources root's .bashrc and sets HOME=/root. sudo bash gives a root shell but inherits the calling user's environment. On the exam, when a question asks for a "full root login environment," the answer is sudo -i or su -.

Reflection Question: A developer needs to restart the nginx service but must not be able to run any other privileged commands. Write the /etc/sudoers.d/ entry that grants exactly this permission, requiring a password.