0

To check the sudo password, we need root permission to even read the /etc/shadow file. But how sudo checks password?

2 Answers 2

2

Since the other answer is just wrong: sudo is owned by root and has the setuid bit set, which means it runs as its owner (root) rather than as whoever launched it. This allows it to verify your password hash against /etc/shadow (or any other authentication provider). This also lets it read /etc/sudoers, which is only readable by root.

1
$ ls -l `which sudo`
-rwsr-xr-x 1 root root ... /usr/bin/sudo
   ^
  

sudo has the setuid attribute set (see the "s" at the marked position), which causes it to run with the effective uid of the file owner, i.e. root. This gives it the necessary permissions for the password check.

2
  • 2
    That is neither the indicator for the sticky bit, nor what the sticky bit does! Did you confuse sticky with setuid? Sticky bit on files does literally nothing on Linux
    – CBHacking
    Aug 8, 2021 at 2:26
  • @CBHacking: you are right. What I marked and what has the described function is not the sticky bit but the setuid attribute. I've fixed the explanation, i.e. changed the name of the bit and linked to the correct Wikipedia page - since the rest is IMHO correct. Aug 8, 2021 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.