sudo Command in Linux: Syntax, Options & Practical Examples

Before installing packages or editing system files, check what your account may run. sudo -l reads /etc/sudoers and shows matching rules for your user.

Run the command:

sudo -l

Sample output (your host will list different commands):

Matching Defaults entries for root on server1:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User root may run the following commands on server1:
    (ALL : ALL) ALL

Add a second -l for the long format when you need RunAsUsers, RunAsGroups, and per-rule command paths:

sudo -ll

Sample output (truncated):

User root may run the following commands on server1:

Sudoers entry: /etc/sudoers
    RunAsUsers: ALL
    RunAsGroups: ALL
    Commands:
	ALL

If the list is empty or says not allowed, your user is not in the sudo group and has no sudoers entry — see Install sudo on Debian or add the account to the right group before retrying.

Use -u when a daemon or service account owns files and you need to confirm access as that identity — common for web roots (www-data) or the unprivileged nobody account.

Run the command:

sudo -u nobody id

Sample output:

uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)

For a numeric UID, prefix the number with # so sudo treats it as an ID, not a username:

sudo -u '#65534' id

Sample output:

uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)

Plain sudo -u 65534 fails on Ubuntu because 65534 is parsed as a username, not a UID.

In cron jobs, CI pipelines, or Ansible plays, use -n so sudo exits immediately if a password would be required instead of hanging on a prompt.

Run the command:

sudo -n true

Sample output (success — no lines, exit code 0):

After you invalidate the cache, the same command fails:

sudo -k
sudo -n true

Sample output:

sudo: a password is required

Pair -n with a targeted sudoers NOPASSWD rule for specific command paths — never grant passwordless ALL on production hosts without a strong reason.

When you need an interactive admin session, -i simulates a root login (root HOME and login environment). -s starts a root shell but keeps more of your current session variables.

Compare HOME and USER:

sudo -i bash -c 'echo HOME=$HOME USER=$USER'

Sample output:

HOME=/root USER=root

sudo -s bash -c 'echo HOME=$HOME USER=$USER'

Sample output:

HOME=/root USER=root

For a non-root target user, -i loads that user's login profile; -s is lighter. Prefer sudo command over long root shells when you only need one or two elevated commands.

By default, sudo applies env_reset and clears most variables for safety. When a script needs a specific export, use -E (if sudoers allows SETENV) or --preserve-env=VAR for a narrow list.

Export a test variable:

export MY_VAR=test123
sudo -E bash -c 'echo MY_VAR=$MY_VAR'

Sample output:

MY_VAR=test123

Preserve only one variable:

sudo --preserve-env=MY_VAR bash -c 'echo MY_VAR=$MY_VAR'

Sample output:

MY_VAR=test123

If the value prints empty, your sudoers Defaults may not allow preserving that variable — check sudo -l for SETENV tags or adjust a drop-in under /etc/sudoers.d/ with visudo.

sudo caches your password for a timeout (often 15 minutes on Ubuntu). Use -v to extend the ticket before a long maintenance window; use -k or -K when you leave a shared console.

Refresh the timestamp without running a command:

sudo -v

Invalidate the cache (next sudo prompts again):

sudo -k
sudo -n whoami

Sample output after -k when a password is required:

sudo: a password is required

Remove the timestamp file entirely:

sudo -K

Use -K on logout from jump hosts so the next operator is not accidentally running as a cached sudo session.

Some programs write config or cache files under $HOME. -H points HOME at the target user's home directory (usually /root when you omit -u).

Run the command:

sudo -H bash -c 'echo HOME=$HOME'

Sample output:

HOME=/root

Use -H when running pip install --user, editors, or build tools as root so they do not litter files in your personal home directory.

-b runs the command in the background and returns your shell immediately — useful for long-running admin tasks you do not want tied to the terminal.

Run the command:

sudo -b sleep 0.1

Sample output (returns immediately, exit code 0):

For configuration files, sudo -e FILE opens $EDITOR with a temp-file workflow. Prefer visudo for sudoers:

EDITOR=true sudo -e /tmp/example.txt

Sample output when the file is unchanged:

sudo: /tmp/example.txt unchanged

Never edit /etc/sudoers with a plain text editor — always sudo visudo or sudo visudo -f /etc/sudoers.d/name.

-g runs the command with the given group as the primary GID. -- tells sudo to stop parsing options so the command can use flags that look like sudo flags.

Run with a specific group:

sudo -g nogroup id

Sample output:

uid=0(root) gid=65534(nogroup) groups=65534(nogroup),0(root)

Pass arguments to the command after --:

sudo -- whoami

Sample output:

root

Use -- when the command itself starts with - or when you need to be explicit about where sudo's options end.