linux - 须藤-i : why does this give a root shell?

Question

运行 sudo -i 我最终在我的 Linux 机器上得到了一个 root shell。

但是阅读 -i 选项时它说:

 -i, --login
                 Run the shell specified by the target user's password database entry as a login shell.  This means that
                 login-specific resource files such as .profile or .login will be read by the shell.  If a command is
                 specified, it is passed to the shell for execution via the shell's -c option.  If no command is speci‐
                 fied, an interactive shell is executed.  sudo attempts to change to that user's home directory before
                 running the shell.  The command is run with an environment similar to the one a user would receive at
                 log in.  The Command Environment section in the sudoers(5) manual documents how the -i option affects
                 the environment in which a command is run when the sudoers policy is in use.

我不是很清楚。

为什么目标用户是root？

这与 sudo su 有何不同？

Answer 1

因为“root”是默认用户。重点来 self 。

-u user, --user=user

Run the command as a user other than the default target user (usually root). The user may be either a user name or a numeric user ID (UID) prefixed with the ‘#’ character (e.g. #0 for UID 0). When running commands as a UID, many shells require that the ‘#’ be escaped with a backslash (‘\’). Some security policies may restrict UIDs to those listed in the password database. The sudoers policy allows UIDs that are not in the password database as long as the targetpw option is not set. Other security policies may not support this.

sudo su 以指定用户(默认为 root)的身份有效地执行 su 命令。

The su command is used to become another user during a login session. Invoked without a username, su defaults to becoming the superuser.

当您以“root”身份运行 su 时(由于使用了 sudo)，您不会被要求使用密码来证明您的身份 - 许多系统不允许“root”使用密码登录，方法是在 /etc/shadow 的字段 2 中放置 ! .

"!" – the account is password locked, user will be unable to log-in via password authentication but other methods (e.g. ssh key) may be still allowed

此外，即使 root 确实有密码访问权限，但在具有多个管理员的系统或共享开发系统上，共享密码并不理想。