sudo(8)
Execute a command as another user, typically the superuser (root), with privilege escalation.
Synopsis
sudo [OPTION]... [COMMAND]Description
sudo allows a permitted user to execute a command as the superuser or another user, as specified by the security policy. It prompts for the user's own password to authenticate, then executes the command with the target user's privileges. The sudoers file controls who can run what commands as whom.
Unlike su, sudo does not require the root password and logs all commands executed. It is the standard mechanism for privilege escalation on modern Linux systems.
Common options
| Flag | What it does |
|---|---|
-u USER | Execute the command as USER instead of root |
-i | Simulate initial login; runs shell as target user with their environment |
-s | Run the shell specified in target user's $SHELL variable |
-l | List the allowed (and forbidden) commands for the invoking user |
-v | Validate sudo credentials; refresh the timestamp without running a command |
-k | Invalidate the cached credentials; requires password on next sudo use |
-n | Non-interactive; fail immediately if a password is required |
-b | Run the command in the background |
-E | Preserve the invoking user's environment variables |
-H | Set the HOME environment variable to the target user's home directory |
Examples
Update package lists with root privileges; will prompt for your password
sudo apt updateRun the psql command as the postgres user instead of root
sudo -u postgres psqlStart an interactive root shell with root's full environment (login shell)
sudo -iStart a non-login root shell in the current directory
sudo -sList which commands you are allowed to run with sudo
sudo -lRe-run the previous command with sudo (bash history expansion)
sudo !!Clear cached credentials, then try to restart nginx non-interactively (fails if password needed)
sudo -k && sudo -n systemctl restart nginxCreate a file as the www-data user
sudo -u www-data touch /var/www/file.txt