Elevated Privileges and User Activity Logs

Linux administrators often need to run commands as other users; this can be because the administrator needs to elevate their privileges to perform an administrative task or because the administrator wants to test commands that would be run by another user. Linux includes the sudo command that allows users to run commands as other users. This is configurable by administrators and may be exploited by attackers. The su command allows an administrator to take on the identity of another user. Polkit is a way administrators can allow one user to take actions as another user; this is used in Linux graphical environments. Administrators need to be able to determine which user(s) are logged on to the system. Some commands (login, sshd) record login data in files like /var/run/utmp which can be queried with different tools to see who is logged on. The PAM module pam_lastlog.so also records logion data which can be queried with different tools. Systemd is used to initialize modern Linux systems, and the systemd-login.service also records logion data which can be queried with loginctl.