Sudo

apk add sudo

Sudo lets a system administrator delegate specific commands to specific users, so people can do their jobs as root without ever having the actual root password. It's one of the most-used pieces of software in computing — nearly every Linux and macOS install leans on it daily — and it's had a strikingly small maintenance team for its entire history.

A brief history

Sudo's roots go back further than most people expect. The earliest version was written around 1980 by Bob Coggeshall and Cliff Spencer at the University at Buffalo's Computer Science department, running on a VAX-11/750. A revised version circulated on Usenet in 1985.

The tool most people actually use today descends from a 1994 fork: Todd C. Miller, then at the University of Colorado Boulder, released "CU sudo" — the "CU" distinguishing it from the original "Root Group" codebase it had diverged from. By 1999 none of that original code remained, the "CU" prefix was dropped, and the project moved to an ISC-style license, which it still uses.

Todd Miller has maintained sudo continuously since, which as of 2026 is over 30 years — an unusually long single-maintainer run for software this widely deployed. Quest Software sponsored his work on sudo as part of his day job from 2010 until February 2024; since then he's been maintaining it independently and has periodically asked the community for sponsorship to keep it going.

What changed with sudo 1.8 and 1.9

For a long time sudo was a fairly monolithic tool: check the sudoers file, run the command, log it. Starting with version 1.8 (2011), sudo gained a plugin architecture — a policy plugin decides whether a command is allowed, and an I/O plugin can capture everything typed and displayed during the session. This is what makes sudo extensible without forking it: third parties can swap in their own policy or logging plugin via /etc/sudo.conf.

Version 1.9 (2020) extended that further with two new plugin types — audit (custom logging, independent of the policy decision) and approval (extra gates that run after the policy plugin approves a command, useful for things like restricting sudo to business hours or requiring a linked support ticket) — plus the ability to write plugins in Python instead of C, and centralized session-recording via sudo_logsrvd.

Security track record

Sudo's long history means it's also had real vulnerabilities. One notable example: a heap buffer overflow (CVE-2021-3156, "Baron Samedit") had been present in the codebase for roughly a decade before it was found in 2021 — it allowed any local user to gain root, even without sudo permissions, under certain configurations. It was patched quickly once reported, which is fairly typical of sudo's disclosure history: issues get fixed, but the tool's ubiquity means any flaw in it is high-stakes.

Partly in response to memory-safety concerns like that one, a Rust reimplementation called sudo-rs has been in development, aimed at closing off the whole class of memory-corruption bugs that C is prone to.

Where it's headed

Sudo isn't limited to Unix-like systems anymore. Microsoft shipped its own "Sudo for Windows" in Windows 11 — built independently rather than as a port of the original project, though clearly inspired by the concept and name.