2

I do most of the "work" I do on my Mac as a Standard user (Apple parlance for an unprivileged user). I also frequently use the CLI (zsh mostly now) via the Terminal app. I use MacPorts as a package manager, and various utilities such as find, rsync, launchctl, ip, mount, log, softwareupdate, etc etc etc. As it frequently happens, something I am trying to do from the CLI requires privilege elevation via the sudo command.

However: According to this document, it seems that Apple does not support the use of sudo by Standard users:

Only administrator users can use sudo. If you’re not logged in as an administrator, you can do so by entering the following command, where adminUsername is the name of an administrator user:

% su adminUsername

This seems clumsy and inconvenient: su and then sudo. It is also at odds with the way sudo works on other platforms I use. Of course macOS requires Admin user authentication to perform some tasks in the GUI, but this is generally not the way that sudo operates; i.e. any user may be granted privileges to perform specified tasks by the Admin user for the system.

I won't ask "why" Apple does it this way as that can only be an opinion here, but I will ask if there is a work-around - can sudo on macOS be made to work as it does on other platforms?

Seamus
  • 4,547
  • 1
    Well done! “Given Apple has done X, how can I do Y?” type questions are some that I love to ask and answer and learn. It calls out for experience and explanation as opposed to just complaining or Monday morning quatrterbacks... – bmike Nov 14 '20 at 19:37
  • @bmike: Oh, please make no mistake - there is some complaining here :) Chief complaint is that open source projects with zero labor costs and bank balances do a vastly superior job to the world's largest corporation (by market cap). This strikes me as disrespect for their customers. – Seamus Nov 14 '20 at 21:41
  • 1
    I love withering criticism when it’s done well. Just complaining isn’t productive, complaining well is the best kind. – bmike Nov 14 '20 at 22:20
  • 1
    I think you're approaching this as someone with experience in system administration and Apple is putting together a standard set of user profiles that can be understood by their very broad and diverse customer base who span the gamut from expert kernel developers to folks who can barely get iTunes working. "Standard User" is not "Apple parlance" as Windows uses it as well. – Allan Nov 14 '20 at 22:26
  • 1
    A "standard user" could be a student or a task worker who should have no rights whatsoever. This generic user profile allows a non technical person to be up and running quickly and be assured that the system is secure. If you, an experienced user, needs more granular access and permission profiles, the ability to create them exists - you just need to create and administer them. – Allan Nov 14 '20 at 22:28
  • 1
    Hey @Allan I’m not so sure anyone’s trying to be mean spirited here or anyone needs to change things... I think Seamus and I are of a similar mind - we will complain about how _we_feel about things once we back it up with some facts or at least an explanation. It’s ok to say, I disagree with that feeling or don’t share it, but probably better to not tell others to re-evaluate things. – bmike Nov 14 '20 at 22:45
  • Is it possible to block people on SE? – Seamus Nov 14 '20 at 22:46
  • @Seamus no. But moderators can set up private chats if needed. Gonna put a hold on comments here for a bit and make some light edits. – bmike Nov 14 '20 at 22:47
  • The voting on this question, and an answer below is interesting. As of today, there have been 6 votes cast on the question, and 8 votes cast on the answer. Everyone will draw their own conclusions from this, but for me, the divergence suggests that criticism of Apple is not well received here. – Seamus Nov 17 '20 at 21:21

1 Answers1

9

sudo on macOS does work as it does on other platforms - at least through macOS 10.15.6:

If you, as a "Standard" user, want or need privileges to perform certain tasks, those privileges may be granted by the Admin user in the sudoers file. If you are both the Admin user, and the unprivileged StandardJoe user, this becomes a bit trite, but here's how it works:

% su AdminUser
# authentication, and then:
Adminuser %

Now, as Adminuser, use the visudo command to edit the sudoers file:

Adminuser % sudo visudo

This will open the sudoers file in an editor (perhaps pico). This next step is not the way things would be done on a multi-user system, but in this case as there's only one user, and we're trying to make a point, we'll abandon convention & 'throw caution to the wind' :)

Add the following line to the sudoers file:

StandardJoeUser ALL = (ALL) /usr/sbin/visudo

Save the file, and exit the editor. Then exit the Admin user's shell:

Adminuser % exit
%

What have we just done? We have given your StandardJoeUser user permission to make any changes he wishes to the sudoers file. With that permission, you - as StandardJoeUser - can add the privileges you need - or ALL the privileges available to the Admin user if you choose.

To continue as StandardJoeUser, we'll now grant him the same privileges under sudo as the Admin user has:

% sudo visudo
# authenticate with StandardJoeUser's password

Again, the sudoers file is opened in the editor. This time, add the following line just below the one added previously:

StandardJoeUser ALL = (ALL) ALL

Once again, save & exit. Now - StandardJoeUser can sudo anything - same as the Admin user. There is no need to change to the Admin user (su); you may sudo under your Standard user's credentials.

Debating the wisdom of this change could be classified as opinion under SE rules, so I'll stop here. The answer to the question should be clear enough now: Yes, sudo on macOS does work the same as on other platforms; it seems the document you referenced could be classified as inaccurate under some definition of the word.

Seamus
  • 4,547
  • 1
    This example is assumes only a binary condition - either no access or full access. This is not the case. There are many points between these two extremes here that user roles and permissions can be defined through the use of ACL's, groups, etc. sudo is just one tool in this tool box. – Allan Nov 14 '20 at 22:34
  • 1
    @Allan: Your comment reflects a misunderstanding of the question, and fails to appreciate the fact that the example serves only to illustrate how the OP can utilize sudo as a "Standard" user in macOS. This answer was never intended to address all the points in between. – Seamus Nov 17 '20 at 01:18