Part II · Your system
15.3 sudo and groups
alsosudosudoersgroupsgroupwheelusermodsuvisudo
TL;DR
sudoruns one command as root, if/etc/sudoers(or a file in/etc/sudoers.d/) allows it.- Usually one group gets that right:
sudoon Debian and Ubuntu,wheelon Fedora. On Arch, you enable thewheelline yourself. - Group changes apply at your next login, not in shells already open.
id # your user and groups
sudo -l # what sudo lets you run
sudo usermod -aG docker alice # add alice to the docker group
On your machine
$ atfq 15.3 User alice (uid 1000, gid 1000) Groups alice, wheel, docker, 4242 Admin member of wheel: the group sudo usually trusts Umask 0022: new files 644 (rw-r--r--), new folders 755
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
usermod -Gwithout-areplaces all your extra groups. Always-aG.- Edit sudoers with
visudo: it checks the syntax, and a broken sudoers can lock everyone out of sudo. - Being in the
dockergroup is as good as being root: whoever can talk to the Docker daemon can mount the whole disk into a container. sudo echo x > /etc/filefails: the redirection runs in your shell, not as root. Useecho x | sudo tee /etc/file.- To use a new group without logging out, run
newgrp dockerin that shell.
Deep dive 2 questions
Why groups and not lists of users?
Groups share rights. A file's group lets a whole team read it, and device
groups give access to hardware without root: video for cameras and GPUs,
dialout or uucp for serial ports, depending on the distro.
Adding a person to a group is one change, in one place, instead of a change on every file they need.
su or sudo?
su asks for root's password and opens a root shell. sudo asks for your
own password, runs one command and logs it. Sharing one root password
between several people is the problem sudo solves. Ubuntu locks root's
password, so su doesn't work there unless you set one.