NEITHER to capability-based security,NOR to Protection Rings!
Capability Based Security are kinda software or program specific with a minimum implementation level(sudo and su don't share any capabilities and they have and are very far from the principal of least privilege!),whereas Protection Rings enforce everything right from the level of processor/CPU(sudo and su has nothing to do with processor or hierarchical architecture)!
Sudo is used to run a particular command with root permissions. The interesting thing is that when you use sudo for a particular command, system prompts you for current user’s password. Once you enter the password, the command runs with root privileges.
Su is used to switch to any user account. System prompts for password corresponding to the switched user. If su is used without any option, a switch to root user account is done. In this case, system prompts for root user’s password.
For example, when editing a system file, we usually need sudo or su to
temporarily switch to user root. Does this example belong to
capability-based security, or to protection rings?
We don't switch to user root, but, only our access/privilege to certain specifc actions are increased and run with root privileges. The process would still run under the same userspace,the only difference that the privilege has been granted that of root! Actually,all this accessibility things are mapped to
/etc/sudoers file where access to each of the task like executing certain applications, modifying system settings, etc... are listed for each sudoers. Not all users are kept in the sudoers list, there might be several users debarred of this for system security!
So whenever we execute
su, there does involve a system call to kernel, i.e.,
setuid() system call is invoked to Linux kernel and then the uid of the user is set to 0(that of root) and hence,prompt
# appears,the whole thing is getting done in the same user's userspace and user-mode and not in the root's userspace!!!