Differences between gksudo/kdesudo, sudo, and su

Write tutorials for Linux Mint here
More tutorials on https://github.com/orgs/linuxmint/discu ... /tutorials and (archive) on https://community.linuxmint.com/tutorial
Forum rules
Don't add support questions to tutorials; start your own topic in the appropriate sub-forum instead. Before you post read forum rules
User avatar
xenopeek
Level 25
Level 25
Posts: 29507
Joined: Wed Jul 06, 2011 3:58 am

Differences between gksudo/kdesudo, sudo, and su

Post by xenopeek »

As this question comes up with some frequency I've summarized the differences between gksudo/kdesudo, sudo, and su below. Based on the default sudoers configuration for Linux Mint 18.

You should generally always use gksudo (on Cinnamon/MATE/Xfce) or kdesudo (on KDE) for running graphical programs as root. Use sudo and su only for command line programs. Otherwise you may end up with the graphical programs changing ownership of files in your home directory to root, which can cause lots of issues.

gksudo, kdesudo, and sudo are authorized with your own password and you need to be a member of the sudo group to be able to use them. su requires you to authorize with the password of the user you're changing to and you don't need to be a member of the sudo group to be able to use it. For gksudo and kdesudo you get a graphical window to type your password in. For sudo and su you type the password on the terminal (which doesn't give you any visual feedback as you type it).

Summary of differences between these commands:
  • gksudo and kdesudo set $HOME to the home directory of root, and set $XAUTHORITY to a new file outside your home directory (though with the same cookie for communicating with the X server), so the program you run doesn't change ownership of files in your home directory to root. Only a limited number of environment variables, and no functions or aliases, are preserved when changing user this way.
  • sudo does neither of those and thus should generally not be used for graphical programs as these use those environment variables. Only a limited number of environment variables, and no functions or aliases, are preserved when changing user this way.
    • sudo -i does set $HOME to the home directory of root, and also changes to that directory, but as it doesn't set $XAUTHORITY should still not be used for graphical programs. Only a limited number of environment variables, and no functions or aliases, are preserved when changing user this way.
    • sudo -H does set $HOME to the home directory of root but as it doesn't set $XAUTHORITY should still not be used for graphical programs. Only a limited number of environment variables, and no functions or aliases, are preserved when changing user this way.
  • su does set $HOME to the home directory of root but as it doesn't set $XAUTHORITY should still not be used for graphical programs. All environment variables (with a few changes), but no functions or aliases, are preserved when changing user this way.
    • su - does the same thing as sudo -i (but you authorize su with root's password and sudo with your own).
(Tested by running the printenv command with each, saving the output, and comparing those with meld.)
Image
User avatar
jimallyn
Level 19
Level 19
Posts: 9075
Joined: Thu Jun 05, 2014 7:34 pm
Location: Wenatchee, WA USA

Re: Differences between gksudo/kdesudo, sudo, and su

Post by jimallyn »

Well done, xenopeek!
“If the government were coming for your TVs and cars, then you'd be upset. But, as it is, they're only coming for your sons.” - Daniel Berrigan
User avatar
Pjotr
Level 23
Level 23
Posts: 19886
Joined: Mon Mar 07, 2011 10:18 am
Location: The Netherlands (Holland) 🇳🇱
Contact:

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Pjotr »

Thank you! :)

Could you please also shed some light on sudo -H, which some people apparently also use as "replacement" for gksudo / kdesudo?
Tip: 10 things to do after installing Linux Mint 21.3 Virginia
Keep your Linux Mint healthy: Avoid these 10 fatal mistakes
Twitter: twitter.com/easylinuxtips
All in all, horse sense simply makes sense.
Cosmo.
Level 24
Level 24
Posts: 22968
Joined: Sat Dec 06, 2014 7:34 am

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Cosmo. »

The option -H does change the value for the variable $HOME - but this does not work for graphical programs. So even with -H option sudo does give the problem and gksudo / kdesudo have to be used for graphical programs.

The Option -H makes sense for using sudo on the command line.and should IMO always be used for that.
Even better: It is possible to configure sudo in a way, that this option gets used automatically, so you can save some key presses and cannot forget it. I don't know, why this does not get done out of the box. I do this since the beginning and have never found any problem out of this.

For changing the sudo configurtion for this, you have to have to edit /etc/sudoers wiith this command:

Code: Select all

sudo visudo
Now insert this line:

Code: Select all

Defaults       always_set_home
Save it and you are done.

2 Warnings about editing this file:
At first, the file sudoers must always end with an empty line.
At second: editing this file has the risk, that the user does a mistake, which might end with the result, that the system gets unusable afterwards. For preventing you against such risk you can - before you edit the file - open a second terminal and open a root-shell with sudo -i. When you have edited and saved the file, test sudo in the first terminal. If this works, you can safely close the root-shell.

Additional tip:
As you are about to edit sudoers you can at the same time do another change: You can change the behavior for the password request in a way, that you get asterisks as a visual feedback, as you get the bullets as visual feedback in graphical requests. You can do this by inserting another new line:

Code: Select all

Defaults       pwfeedback
User avatar
xenopeek
Level 25
Level 25
Posts: 29507
Joined: Wed Jul 06, 2011 3:58 am

Re: Differences between gksudo/kdesudo, sudo, and su

Post by xenopeek »

Cosmo. already covered it. But to add in same style as above:
  • sudo -H does set $HOME to the home directory of root but as it doesn't set $XAUTHORITY should still not be used for graphical programs. Only a limited number of environment variables, and no functions or aliases, are preserved when changing user this way.
Image
Cosmo.
Level 24
Level 24
Posts: 22968
Joined: Sat Dec 06, 2014 7:34 am

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Cosmo. »

As the wrong usage of sudo is one of the mostly be done user mistakes I recommend to pin this thread.
User avatar
Pjotr
Level 23
Level 23
Posts: 19886
Joined: Mon Mar 07, 2011 10:18 am
Location: The Netherlands (Holland) 🇳🇱
Contact:

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Pjotr »

Cosmo. wrote:As the wrong usage of sudo is one of the mostly be done user mistakes I recommend to pin this thread.
I second that (thanks for the explanation of sudo -H, by the way).

@xenopeek: maybe you could add the explanation of sudo -H to your first post? That's clearer for other people....
Tip: 10 things to do after installing Linux Mint 21.3 Virginia
Keep your Linux Mint healthy: Avoid these 10 fatal mistakes
Twitter: twitter.com/easylinuxtips
All in all, horse sense simply makes sense.
User avatar
austin.texas
Level 20
Level 20
Posts: 12003
Joined: Tue Nov 17, 2009 3:57 pm
Location: at /home

Re: Differences between gksudo/kdesudo, sudo, and su

Post by austin.texas »

Thank you for an excellent guide to gksudo/kdesudo, sudo, and su.
Could you please add some information about pkexec?
I do not feel competent to try to explain that, personally.

Code: Select all

mint@mint ~ $ pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY $i
SHELL=/bin/bash
LANG=en_US.UTF-8
TERM=xterm
COLORTERM=gnome-terminal
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games
LOGNAME=root
USER=root
HOME=/root
PKEXEC_UID=1000
XDG_SESSION_ID=c1
XDG_RUNTIME_DIR=/run/user/0
XDG_SEAT=seat0
XDG_VTNR=8
DISPLAY=:0
XAUTHORITY=/home/mint/.Xauthority
Mint 18.2 Cinnamon, Quad core AMD A8-3870 with Radeon HD Graphics 6550D, 8GB DDR3, Ralink RT2561/RT61 802.11g PCI
Linux Linx 2018
Habitual

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Habitual »

Cosmo. wrote:As the wrong usage of sudo is one of the mostly be done user mistakes I recommend to pin this thread.
Pin it. Lock it. Whatever it takes to preserve it. :)
I have so few authoritative LM articles to give users.
Now I have one more.

Thank you for your time.
JJ
User avatar
Pjotr
Level 23
Level 23
Posts: 19886
Joined: Mon Mar 07, 2011 10:18 am
Location: The Netherlands (Holland) 🇳🇱
Contact:

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Pjotr »

austin.texas wrote:Could you please add some information about pkexec?
That would indeed be useful as well....

My own current take on pkexec: it's a convoluted, unusably complicated way of achieving the same level of protection as gksudo offers. Totally impractical and unfit for general use. :evil:
Tip: 10 things to do after installing Linux Mint 21.3 Virginia
Keep your Linux Mint healthy: Avoid these 10 fatal mistakes
Twitter: twitter.com/easylinuxtips
All in all, horse sense simply makes sense.
User avatar
xenopeek
Level 25
Level 25
Posts: 29507
Joined: Wed Jul 06, 2011 3:58 am

Re: Differences between gksudo/kdesudo, sudo, and su

Post by xenopeek »

I've stickied the topic and added the sudo -H part and made a few minor changes.

As for pkexec, it does set $HOME safely but as austin.texas gave the example it uses the .Xauthority file in your own home directory. The pkexec manpage makes clear that setting the $DISPLAY and $XAUTHORITY environment variables is discouraged and should only be used for legacy programs. Who wants to be the one to admit they use "legacy programs" (I'm thinking COBOL? :lol:). I'm no expert on pkexec but I think Polkit is intended to do away with need to run an entire program as root. The manpages for those interested:
https://www.freedesktop.org/software/po ... kit.8.html
https://www.freedesktop.org/software/po ... xec.1.html
Image
User avatar
slipstick
Level 6
Level 6
Posts: 1071
Joined: Sun Oct 21, 2012 9:56 pm
Location: Somewhere on the /LL0 scale

Re: Differences between gksudo/kdesudo, sudo, and su

Post by slipstick »

Thanks for this tutorial. I have also seen

Code: Select all

gksu
recommended in some posts. To avoid confusion on this, note that gksudo is just a link to gksu.

Here is an old thread that got reopened recently with info about

Code: Select all

sudo -s
viewtopic.php?f=47&t=690

And another thread about

Code: Select all

pkexec
that left me thoroughly confused.
viewtopic.php?f=47&t=221167#p1161348
In theory, theory and practice are the same. In practice, they ain't.
deleted

Re: Differences between gksudo/kdesudo, sudo, and su

Post by deleted »

...and I finally untaught my fingers from typing "sux" ;)
-H
Cosmo.
Level 24
Level 24
Posts: 22968
Joined: Sat Dec 06, 2014 7:34 am

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Cosmo. »

slipstick wrote:note that gksudo is just a link to gksu.
Not necessarily. Yes, by default gksu uses sudo as authentication method (so it behaves like gksudo), but this can be changed and consequently this is not the same on every system and not even for every user account on the same machine, as this is a per-user-setting.

You can change this either temporarily or permanent. For temporary using of su as backend you have to set the option -w (gksu -w ....).

You can change this also permanently. Enter(in a terminal or the commandline via alt-F2) gksu-properties. This gives a graphical dialog, where you can switch to su as authentication method. This makes sense IMO, as this allows to run graphical programs without sudo-membership, if you know the password of the other user. With the default setting gksudo and gksu behave the same, what appears to be a needles redundancy.

If you have done this permanent switch, you have again the possibility to temporarily using sudo as backend. The option is in this case -S.
Note (a little bit confusing): -w needs a not capitalized w, -S needs a capital S.
User avatar
slipstick
Level 6
Level 6
Posts: 1071
Joined: Sun Oct 21, 2012 9:56 pm
Location: Somewhere on the /LL0 scale

Re: Differences between gksudo/kdesudo, sudo, and su

Post by slipstick »

Thanks for the explanation. I had just examined my system and assumed that was the standard for Mint. But I've got to say that this whole area seems to be a rat's nest of complexity.
In theory, theory and practice are the same. In practice, they ain't.
afifaadam

Re: Differences between gksudo/kdesudo, sudo, and su

Post by afifaadam »

Both files purpose to a similar place:

$ ls -l /usr/bin/gksudo
lrwxrwxrwx one root root four 2010-09-27 18:23 /usr/bin/gksudo -> gksu

... gksudo is symlinked to gksu. however this does not mean they are doing a similar things, off from it.

Applications will notice the command accustomed run it. this is often generally argv[0] in C-style languages or $0 in Bourne-style shell scripts. the applying will look into that and during this case, truly it changes however it works. the primary indication of this is often within the man gksu page:

gksu is a frontend to su and gksudo could be a frontend to sudo.

If you look within the supply (apt-get supply gksu) for run_mode, you will see however it detects this:

run_mode = SUDO_MODE;
g_free (myname);
">

You can override this with the --su-mode/-w and --sudo-mode/-S arguments (so you'll run equivalent commands without having the gksudo symlink... however that is up to you.

If you would like to grasp however these "modes" very dissent, there is solely a small amount of escaping in gksu. you wish to follow it into libgksu. this is often the library that really checks permissions before handing off to the system.

If no mode is nominal (eg you decision gksu while not arguments) by the time it reaches libgksu, it'll check Gconf (as Stefano points out) and if it still cannot decide, it will default to the su mode.
nakednorman

Re: Differences between gksudo/kdesudo, sudo, and su

Post by nakednorman »

As this question comes up with some frequency I've summarized the differences between gksudo/kedsuo, sudo, and su below. Based on the default sudoers configuration for Linux Mint 18.
I think the "kedsuo" above may be a typo but I'm too much of a newbie to be 100% sure? :)
NN
Cosmo.
Level 24
Level 24
Posts: 22968
Joined: Sat Dec 06, 2014 7:34 am

Re: Differences between gksudo/kdesudo, sudo, and su

Post by Cosmo. »

kdesudo is needed (only) for the kde-edition. No typo.
User avatar
austin.texas
Level 20
Level 20
Posts: 12003
Joined: Tue Nov 17, 2009 3:57 pm
Location: at /home

Re: Differences between gksudo/kdesudo, sudo, and su

Post by austin.texas »

nakednorman wrote:I think the "kedsuo" above may be a typo but I'm too much of a newbie to be 100% sure? :) NN
xenopeek wrote:As this question comes up with some frequency I've summarized the differences between gksudo/kedsuo, sudo, and su below. Based on the default sudoers configuration for Linux Mint 18.
Yes, you are right, that is a typo. It is kdesudo
Mint 18.2 Cinnamon, Quad core AMD A8-3870 with Radeon HD Graphics 6550D, 8GB DDR3, Ralink RT2561/RT61 802.11g PCI
Linux Linx 2018
vladtepes

Re: Differences between gksudo/kdesudo, sudo, and su

Post by vladtepes »

Perhaps for the sake of clarity you could more precisely define what you mean by "graphical programs" please?


(Do you mean any programs that have a GUI, and if so why would you be running these from the command line anyway?)
Post Reply

Return to “Tutorials”