While both commands achieve root privileges, their execution paths differ significantly:
# sudo -i execution flow:
1. Reads /etc/sudoers for policy
2. Spawns new shell as root (login shell)
3. Loads root's environment variables
4. Changes to root's home directory
# sudo su - execution flow:
1. sudo executes su command
2. su performs authentication (may prompt for root password)
3. su spawns login shell
4. Environment gets rebuilt
The most critical distinction lies in environment variable processing:
$ sudo -i
# env | grep PATH
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
$ sudo su -
# env | grep PATH
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
sudo -i
completely resets the environment to root defaults, while sudo su -
may inherit some variables from the original user's environment through the sudo wrapper.
Consider these real-world scenarios where the choice matters:
# For secure environment isolation (recommended):
$ sudo -i
# Now running with clean root environment
# When needing to keep certain user env vars:
$ sudo su -
# May preserve some inherited paths
From an auditing perspective:
# sudo -i leaves clearer audit trail:
Jun 15 10:00:00 server sudo: alice : TTY=pts/0 ; USER=root ; COMMAND=/bin/bash -i
# sudo su - creates two log entries:
Jun 15 10:01:00 server sudo: alice : TTY=pts/0 ; USER=root ; COMMAND=/bin/su -
Jun 15 10:01:00 server su: pam_unix(su-l:session): session opened for user root by alice(uid=0)
For different use cases:
# Recommended for most admin tasks:
sudo -i
# When you specifically need su behavior:
sudo su -
# Alternative for single commands:
sudo --shell
Note that some Linux distributions (like Ubuntu) disable direct root login, making sudo -i
the preferred method.
Both sudo -i
and sudo su -
are commands used to gain root privileges in Linux systems, but they achieve this through different mechanisms and with subtle behavioral differences.
# Example of sudo -i
$ sudo -i
# Now in root's home directory with root's environment
# Example of sudo su -
$ sudo su -
# Also in root's home directory with root's environment
The primary technical difference lies in how environment variables are processed:
# Check environment with sudo -i
$ sudo -i
# env | grep HOME
HOME=/root
# Check environment with sudo su -
$ sudo su -
# env | grep HOME
HOME=/root
While both set the HOME to /root, sudo -i
preserves more of the original user's environment (with some sanitization) while sudo su -
gives you a completely fresh login environment.
sudo -i (simulated initial login):
- Creates a new shell as root
- Runs root's profile scripts (~/.profile, ~/.bashrc, etc.)
- Changes to root's home directory
- Preserves some caller environment variables
sudo su - (substitute user with login):
- sudo executes su as root
- su - initiates a login shell for root
- Completely resets environment variables
- Runs all login scripts
When to use sudo -i:
# For administrative tasks needing some original environment
$ sudo -i
# apt-get update
# exit
When to use sudo su -:
# For complete isolation from user environment
$ sudo su -
# service apache2 restart
# exit
Security implications:
The sudo su -
approach spawns an additional process (the su command), which might be restricted in some tightly controlled environments.
In /etc/sudoers, you can control these behaviors:
# Allow only sudo -i but not sudo su -
username ALL=(ALL) ALL, !/bin/su
This configuration permits sudo -i
but explicitly denies the su
command.
Understanding these differences helps in writing more precise automation scripts and configuring appropriate sudo privileges in production environments.