root vs sudo: Why You Shouldn't Work as root

root vs sudo: Why You Shouldn't Work as root
Reading time: About 10 min Difficulty: Introduction

What you'll be able to do

  • Explain the difference between root and a normal user
  • Understand why you avoid working as root, and use sudo safely

Prerequisites (read these first)

You Were Told to Add sudo, but What Is root?

When you follow a tutorial online, you keep seeing commands that start with sudo, like sudo apt update. Maybe you treat it as a magic word you add to make things work. Dig deeper and you hit warnings like "don't work as rootThe special administrator account allowed to do anything on the system." and "use least privilege." That only adds to the confusion.

root is the do-anything administrator account on Linux. sudo is a way to borrow that power for a single command. In this guide, Lina and Linny-senpai sort out why you stay a normal user and reach for sudo only when needed. By the end, sudo becomes a safety device you understand, not a spell you chant.

What You'll Learn

  • That root (the superuser) is a special account that can do anything
  • Why staying logged in as root is dangerous
  • That sudo borrows privileges for just one command
  • The difference between su and sudo
  • The basic form sudo command
  • The idea behind the "principle of least privilege"

1. What Is root, Really?

Conclusion: root is the one special administrator account allowed to do everything on Linux. It bypasses all permissionThe read / write / execute access rules set on a file or directory. checks and can read, write, or delete any file on the system.

Lina: Linny-senpai, I keep seeing sudo in front of commands. But what is root in the first place?
Linny-senpai: root is the most powerful account on Linux—the one that can do anything. "Superuser," "administrator," and "privileged user" are all different names for the same thing.
Lina: When you say "anything"...?
Linny-senpai: Think of a school caretaker holding the master key to every room. root can edit system config files a normal user can't touch. It can install software machine-wide. It can even delete other people's files.
Lina: So no room stays locked for root.
Linny-senpai: Exactly. Linux's permission checks simply don't apply to root.
Lina: Wait, then it's the strongest. Why not just use root all the time and solve everything?
Linny-senpai: That's the natural thought—but it's exactly what you must not do. Let me explain why, step by step.

root = an account exempt from permission checks

  • Its username is root, and its user ID (UID) is 0
  • It can read, write, and delete everything regardless of a file's permissions (rwx)
  • It can perform system-wide actions (installing packages, restarting services, adding users)

It's more accurate to think "the limits are removed" than "it's strong." For permissions themselves, see A Mental Model for Permissions.

2. Why Is Working as root Dangerous?

Conclusion: Because root skips permission checks, a single typo can break the whole system. The real danger is that mistakes and malware reach "every area" instead of being contained.

Lina: It's powerful and convenient, so why shouldn't I use root every day?
Linny-senpai: Because "can do anything" also means "can break anything." As a normal user, you get stopped even if you accidentally try to delete an important file.
Lina: How does it stop me?
Linny-senpai: The screen shows "Permission denied" and the action is cancelled.
Lina: And root never shows that message?
Linny-senpai: Never. root has no such brake. Say you mistype the directoryA container that organizes files. Same idea as a "folder" on Windows or macOS. you want to delete. root runs it with no warning.
Lina: It deletes as far as the typo reaches?
Linny-senpai: Right. Areas that a normal user's permission walls would have protected get wiped out entirely.
Lina: That's scary. But I'll be fine if I'm just careful, right?
Linny-senpai: Humans always make mistakes. And mistakes are not the only risk.
Lina: What else is there?
Linny-senpai: Malware — malicious software; "virus" is another name for the same thing. Suppose a program you run as root contains malware. That damage also runs with root's power. The whole system gets taken over.
Lina: So it's dangerous even when I do nothing wrong.
Linny-senpai: Right. That's why the rule is to keep your privileges low by default.

Deleting does not send files to a trash can

If you're used to the Recycle Bin on Windows or the Trash on macOS, this is the biggest trap.

  1. Difference from the GUI: a file removed with rm never lands in a trash can. It is gone immediately.
  2. The safer option: rm -i asks "delete this?" for each file before removing it.
  3. One reassurance: the virtual terminalAn interactive program that reads the commands you type and runs them. on this site is for learning. Your own computer stays safe, so try things freely.

Run rm as root and that "gone for good" range widens to the whole system. That's why you stay a normal user by default.

3. What Does the sudo Command Do?

Conclusion: sudo runs just one command with root's privileges. You stay a normal user and borrow power only when you need it.

Lina: So when I do need admin rights, what should I do?
Linny-senpai: That's where sudo comes in. sudo stands for "superuser do," and it asks the system to "run just this one command as the administrator."
Lina: Is "just one" the key point?
Linny-senpai: Exactly. When you type sudo apt update, only that apt update command runs with root's privileges. The moment it finishes, you're back to your normal user. You don't stay as root.
Lina: Like borrowing the staff room key and returning it as soon as you're done.
Linny-senpai: Precisely. And there's a record (a log) of who ran what with sudo, and when. Unlike "always root," responsibility stays clear.

sudo = borrow privileges for "just one command"

  • Only the command prefixed with sudo runs with root privileges
  • You return to your normal user immediately afterward (you don't stay as root)
  • The first time, it asks for your own password (not root's password)
  • It logs who ran what and when

Not "administrator forever," but "administrator for the single moment you need it." That's the heart of staying safe.

Sequence diagram: the user hands a command to sudo, the command runs with root privileges, and the result comes back to the user. The root lifeline carries an orange band marking the window where privileges are active

Figure 1: Privileges are borrowed only while the right-hand lifeline shows the orange band. The rest of the time, the user stays a normal user. The root lane is not another person — it stands for root's privileges — and stdout means the command's output. The password promptA symbol (like $ or #) shown when the shell is waiting for your input. is left out of the diagram.

4. How Are su and sudo Different?

Conclusion: su switches you into root and stays there; sudo borrows privileges for one command and returns them immediately. For everyday use, sudo is the safe choice.

Lina: I also saw a similar command, su. How is it different from sudo?
Linny-senpai: Good question. su (substitute user) switches users. With no argument it switches you to root. Once you switch, you stay as root until you exit.
Lina: Staying as root the whole time... that's the dangerous part you mentioned.
Linny-senpai: Right. After su makes you root, every command you type runs with root privileges. The no-brake state continues. With sudo, it's per command, so you spend only a moment in the dangerous state.
Lina: That's why sudo is recommended.
Linny-senpai: Exactly. Modern systems like Ubuntu disable direct root login by default. Handling daily admin tasks with sudo is the modern convention.
Item su sudo
What it does Switch to root and stay there Borrow privileges for one command
Scope of power root until you exit Only while that command runs
Password asked root's password your own (the running user's)
Logging Becoming root is logged, but what you then do is not Records who did what
Everyday use Discouraged Recommended

sudo su exists too, but start with sudo command

There's also sudo su or sudo -i to "enter a root shell via sudo" — a shell is the interactive program that receives the commands you type and runs them; "terminal" and "console" refer to much the same thing. It's used when you need to run several admin tasks in a row, but it carries the same risk as su because you sit in a root shell. While you're a beginner, it's safer to get used to the basic form: add sudo to each command.

5. How Do You Use sudo? (The Basic Form)

Conclusion: Just put sudo in front of the command that needs admin rights. The basic form is sudo <command>, and it asks for your own password the first time.

Lina: Show me how to actually use it.
Linny-senpai: It's easy. Just put sudo in front of a command that needs admin rights. For example, to refresh the package list — a package is the format Linux uses to distribute software — you type this.
Lina: So you just add it to the start of the command.
Linny-senpai: Right. It asks for your password once at first (nothing shows on screen, but your typing is registered). Once you pass, it won't ask again for a while as you keep working.
sudo apt update
[sudo] password for lina:
Hit:1 http://archive.ubuntu.com/ubuntu jammy InRelease
...

You can check who you are right now with whoami.

whoami
lina

Only inside the sudo-prefixed command do you act as root; once it ends, you're back to lina.

Check what you're allowed to do with sudo -l

Which users may use sudo, and which commands they can run, is managed in a config file called /etc/sudoers. To list the sudo actions allowed to you, run this.

sudo -l

Knowing "what I can run with admin rights" makes it faster to diagnose a Permission denied dead end.

6. What Is the Principle of Least Privilege?

Conclusion: The idea of holding only the minimum privileges needed for the task. Stay a normal user day to day and borrow admin rights only for the moment you need them, reducing both accidents and damage.

Lina: If you sum up everything so far in one phrase, what is it?
Linny-senpai: The "principle of least privilege." It means you hold no more privileges than you strictly need.
Lina: Like staying weak by default and getting strong only when needed?
Linny-senpai: Exactly. If you're always at maximum power (root), then the damage from mistakes and malware is at maximum too. But if you stay a normal user, the damage stops within your reach. And you borrow root with sudo only for the one moment you need it.
Lina: So that's why "don't work as root" and "use sudo" are said together.
Linny-senpai: Right. This isn't just a Linux thing—it's a universal rule in security. Remembering it will serve you for a long time.

Least privilege becomes a habit

  • Log in as a normal user day to day (don't live as root)
  • Add sudo only to commands that need admin rights
  • Before adding sudo, pause and ask "does this command truly need admin rights?"
  • Don't copy-paste and run a sudo command you don't understand

Make "give strong privileges back quickly" a habit, and you'll prevent most accidents.

7. How Do You Try It Hands-On?

Conclusion: Check who you are with whoami, then actually type commands with and without sudo to see how access changes. That's the fastest way to understand.

Lina: I think I get it in my head, but it doesn't feel real yet...
Linny-senpai: The best way is to type and check. Confirm who you are with whoami, then try a privileged action with and without sudo—you'll feel "ah, this is where admin rights are needed."
Lina: I'm a bit scared to try admin commands on my own machine.
Linny-senpai: Then use a playground you can try safely in the browser. You can feel out whoami and the sense of privileges without worrying about breaking anything.
whoami
id
lina
uid=1000(lina) gid=1000(lina) groups=1000(lina),27(sudo)

If the id output includes a sudo group (Ubuntu and Debian) or a wheel group (RHEL family), that user can use sudo. If uid is anything other than 0 (like uid=1000), you're a normal user right now, not root.

Type whoami in the Penguin Gym Linux terminal and confirm "who am I right now." Once you grasp the sense of privileges, deciding whether to add sudo becomes second nature.

id and sudo -l are not supported in this site's terminal. Try those two on a real machine, such as Ubuntu.

Lina Forgets to Add sudo

Conclusion: As a normal user, creating a file in a system directory stops with Permission denied. Adding sudo lets it through (this example is from a real Ubuntu machine).

Lina: Let me practice placing a system config file. I'll create an empty file in /etc.
touch /etc/example.conf
touch: cannot touch '/etc/example.conf': Permission denied
Lina: It refused me. I'm sure the command is correct...
Linny-senpai: That's exactly right. /etc is a place normal users can't write to. This is proof that the brake worked.
Lina: So it's protection, not a broken command.
Linny-senpai: Right. This is the moment you learn "this command needs admin rights." So you add sudo and try again.
sudo touch /etc/example.conf
ls -l /etc/example.conf
-rw-r--r-- 1 root root 0 Jun  6 10:10 /etc/example.conf
Lina: It worked this time. And the owner is root.
Linny-senpai: Great catch. A file created with sudo belongs to root. Try without sudo first, then add it when you're refused—that way you never use privileges you don't need.

Mini Exercises

Conclusion: Type the whoami, id, and sudo -l commands from this guide and check your own privileges.

Linny-senpai: Let's confirm what you learned with your own hands. Here are three exercises.

Exercise 1: Check Who You Are Right Now

Task: Display the username you're logged in as.

Show Hint 1 (Direction)

There's a command whose name reads like the question "who am I?"

Show Hint 2 (Command name)

Use whoami. It's "who am i" squeezed into one word.

Show Answer 
whoami
lina

Exercise 2: Check Whether You're in the sudo Group

Task: Display your groups and see whether sudo is among them.

Show Hint 1 (Direction)

One command prints your user ID and your groups together. It's two letters long.

Show Hint 2 (Command name)

Use id, then look at the groups= part of the output.

Show Answer 
id
uid=1000(lina) gid=1000(lina) groups=1000(lina),27(sudo)

If groups= contains 27(sudo) (or wheel on the RHEL family), that user can use sudo. Try this exercise on a real machine, such as Ubuntu.

Exercise 3: List the sudo Actions Allowed to You

Task: Display which sudo actions you are permitted to run.

Show Hint 1 (Direction)

sudo itself takes an option that lists your permissions. Think of the first letter of "list."

Show Hint 2 (Command name)

Use sudo -l.

Show Answer 
sudo -l
User lina may run the following commands on penguin:
    (ALL : ALL) ALL

The real output also starts with a Matching Defaults entries block, so part of it is omitted here. The first time, it asks for your password: nothing appears on screen as you type, but just type it and press Enter. Try this exercise on a real machine too.

Review

Conclusion: root is an account with the limits removed; sudo borrows power for a single moment. That distinction is what least privilege is built on.

Lina: So root is like walking around holding the master key, and sudo is borrowing a key only when you need it and returning it right away.
Linny-senpai: That's exactly right. It's also why adding sudo per command beats settling into a root shell with su.
Lina: And I'll try without sudo first, then add it when I'm refused.
Linny-senpai: A good habit. That's the principle of least privilege applied to your daily typing.

Today's 3-Line Summary

Conclusion: Understand what root is, how sudo works, and the principle of least privilege, and admin rights stop being scary.

  1. root is an account exempt from permission checks - it can do anything, so its mistakes and damage reach the entire system
  2. sudo <command> borrows privileges for one command - unlike su you never settle in as root, and every run is logged
  3. Make least privilege a habit - normal user by default, administrator for a moment; check your permissions with sudo -l

Next Reading

Share this article

Next steps

Next article → A Mental Model for Linux Permissions: rwx and owner/group/other Practice with quiz → Verify your understanding Practice with lesson → Run commands in the terminal