Linux Privilege Escalation Explained: su, sudo su, su -, sudo -s, sudo -i and More

Adefemi Oluwaseun (whoami)

8 min read

·

Oct 18, 2026

--

Listen

Share

Press enter or click to view image in full size

Understanding the difference between switching users, becoming root, and starting a login shell in Linux.

If you are learning Linux administration, cybersecurity, or Linux kernel engineering, you will eventually encounter commands such as su, sudo, sudo su, sudo -s, and sudo -i.

At first glance, they appear to do the same thing: give you access to the root account.

But they are not exactly the same.

Some commands switch your identity. Others execute commands with elevated privileges.

Some create a new shell, while others create a login environment that loads the target user’s configuration.

In this article, we will break down these commands in simple English, explain what happens behind the scenes in Linux, and troubleshoot a real error encountered in a Kali Linux virtual machine.

1. First, understand the Linux root user

Think of Linux as a building with different access levels.

A regular user is like an employee who can access their own workspace and perform permitted tasks.

The root user is like the system administrator who has almost unrestricted control over the entire building.

In Linux, the root account has a User ID (UID) of 0.

You can check your current identity with:

whoami

Example output:

kali

Check your numeric user ID and group memberships:

id

Example output:

uid=1000(kali) gid=1000(kali) groups=1000(kali),27(sudo)

Now become root using:

sudo -s

Then run:

whoami

Expected output:

root

You are now running a shell with root privileges.

Important Linux concept: Your username, UID, group memberships, shell, and environment variables are different pieces of information. Understanding these differences will help you troubleshoot privilege-related problems.

2. What is su?

The su command means substitute user. It allows you to switch to another user account.

In simple English, imagine leaving your own desk and sitting at another user’s desk, using that person’s account identity.

Step 1: Switch to root

su

On a typical Linux system, this attempts to switch to root.

You may be prompted for the root password.

If authentication succeeds, you become root. If the root account has no usable password or your system is configured differently, the command may fail.

Verify your identity:

whoami

Expected output:

root

Step 2: Switch to a specific user

su username

Replace username with an actual account name.

For example:

su kali

This switches to the kali account, generally retaining much of the calling environment rather than creating a complete login environment.

Step 3: Understand the limitation

Switching users does not necessarily give you a clean login environment. Environment variables and the working directory may differ from what you would get when logging in normally.

That is why Linux provides the - option.

3. What is su -?

The command:

su -

switches to root and starts a login shell.

Think of su as entering another user's workspace, while su - is more like leaving your workspace and logging in afresh as that user.

A login shell typically initializes the target user’s environment, changes to their home directory, and reads the applicable login startup files.

Step-by-step example

First, check your current location:

pwd

You might see:

/home/kali

Now run:

su -

After authenticating, check:

whoami
pwd
echo "$HOME"

Typical output:

root
/root
/root

The exact output depends on your system configuration, but the important point is that su - establishes a root login environment.

When should you use su -?

Use it when you need to switch accounts and want the target user’s login environment.

For example, when administering a Linux system directly as root.

On Kali Linux, however, the root account may not have a password configured for direct authentication. In that case, if your account has sudo privileges, sudo -i is often the more convenient option.

4. What is sudo su?

Let’s break the command into two parts:

sudo su

• sudo authorizes the command to run with elevated privileges according to the system's sudo policy.
• su then attempts to switch to the root account.

In simple English, you are using your authorized administrator privileges to launch the program that switches users.

What happens behind the scenes?

The general process is:

1. You enter sudo su.
2. sudo checks whether your account is authorized.
3. If permitted, sudo launches su with elevated privileges.
4. su attempts to establish the root session.

On many systems, this works without asking for the root password because sudo has already launched su with root privileges.

Is sudo su the same as su -?

No.

sudo su does not explicitly request a login shell. The environment and shell behavior depend on the su implementation and configuration.

If you want to request a root login shell using su, the corresponding command is:

sudo su -

Nevertheless, sudo -i is usually the cleaner and more direct option when you have sudo access.

5. What is sudo -s?

The command:

sudo -s

starts a shell with elevated privileges.

Think of it as being given administrator access inside a command-line workspace, without necessarily recreating a full root login session.

Step-by-step example

Run:

sudo -s

Then check:

whoami
id
pwd
echo "$HOME"
echo "$SHELL"

You should generally see that your effective identity is root, but some environment details may still reflect the calling user or the shell configuration.

The exact environment depends on your sudo settings and the shell being selected.

Why is sudo -s useful?

It is convenient when you need to execute several administrative commands in succession.

For example:

sudo -s
apt update
apt upgrade
exit

Here, exit leaves the privileged shell and returns you to your previous shell.

Security tip: Do not remain in a root shell longer than necessary. A typo in a privileged command can damage the operating system.

6. What is sudo -i?

The command:

sudo -i

starts a root login shell.

The -i option tells sudo to simulate an initial login for the target user. With the default target user, that is root.

Step-by-step example

sudo -i

Now run:

whoami
pwd
echo "$HOME"

Typical output:

root
/root
/root

The shell is running with root privileges and a login-style environment.

Why use sudo -i instead of sudo su -?

Both commonly produce a root login shell, but they reach that result differently.

• sudo -i directly asks sudo to start the target user's login shell.
• sudo su - asks sudo to run su, which then performs the user switch.

For routine administration when sudo access is available, sudo -i is generally the more straightforward choice.

7. Other useful commands: sudo command, sudo -u and sudo -l

You do not always need to open a root shell.

Run one command as root

sudo apt update

This runs that particular command with elevated privileges.

Once it finishes, you return to your normal shell.

Run a command as another user

sudo -u username command

For example:

sudo -u nobody whoami

If permitted and the account is available, this runs whoami under the nobody account.

See what you are allowed to run

sudo -l

This displays the sudo privileges available to your account.

Return to your regular user

When you are inside a root shell:

exit

You can also press Ctrl+D to end the shell.

8. Comparison table: Which command should you use?

su Switch to root by default or another user > Not normally a login shell

su -Switch to root by default with a login shellYes

sudo suUse sudo to launch

suNot explicitly requested

sudo su -Use sudo to launch a root login shell through suYes

sudo -sStart a privileged shellNot necessarily

sudo -iStart a privileged login shellYes

sudo commandRun one command with elevated privilegesNo new persistent shell

sudo -u user commandRun a command as another userDepends on the command and options

sudo -lList available sudo privilegesNot applicable

The key distinction is that privilege level and login environment are separate concepts. A root shell does not automatically mean you have a fresh root login environment.

9. Real-world troubleshooting: Why does sudo su fail while sudo -s works?

Consider this error from a Kali Linux virtual machine:

$ sudo su
su: failed to execute whoami: No such file or directory

Yet this command works:

sudo -s

Why might this happen?

The error indicates that su attempted to execute whoami as a shell or executable, but could not find it in the expected location.

One possibility is that the root account’s configured login shell is incorrectly set to whoami. Other possibilities include a missing executable or a configuration issue.

The fact that sudo -s works does not prove that the root account's shell is configured correctly. It may be using a different shell-selection path.

Step 1: Inspect the root account

Enter a privileged shell:

sudo -s

Then run:

getent passwd root

A typical healthy result is:

root:x:0:0:root:/root:/bin/bash

The last field identifies the configured login shell.

If it ends in whoami, that is suspicious.

Step 2: Inspect the executable

Run:

command -v whoami
ls -l /bin/bash /usr/bin/whoami

On a typical Kali installation, Bash and the whoami executable should be present at these paths.

Step 3: Correct the shell only if it is wrong

If the root account is confirmed to have whoami configured as its login shell, correct it with:

usermod -s /bin/bash root

Then verify:

getent passwd root

Do not change the root shell blindly if the output already shows a valid shell.

Step 4: Test again

Exit the privileged shell:

exit

Then try:

sudo su
sudo -i

If sudo su still fails, inspect the shell configuration and executable paths before making additional changes.

This is an important Linux troubleshooting lesson: do not assume two commands that provide root access follow the same execution path.

10. A practical lab to reinforce your understanding

Run these commands in your Kali Linux VM, one at a time.

Lab A: Establish your baseline

whoami
id
pwd
echo "$HOME"

Lab B: Compare privileged shells

sudo -s
whoami
pwd
echo "$HOME"
exit

Then:

sudo -i
whoami
pwd
echo "$HOME"
exit

Lab C: Inspect root configuration

getent passwd root

Lab D: Compare single-command privilege escalation with an interactive shell

sudo whoami
whoami

The first command should report root, while the second should report your regular user if you have returned to your normal shell.

Observe the results instead of memorizing the commands. This is how you build practical Linux administration skills.

Conclusion

Understanding su, sudo su, su -, sudo -s, and sudo -i is not just about memorizing syntax. It is about understanding Linux identity, privileges, shell selection, and environment initialization.

For everyday administration, use sudo command for individual tasks and sudo -i when you need a root login shell. Use sudo -s when you need an interactive privileged shell without necessarily requiring a login environment.

Most importantly, when a command fails, investigate the configuration rather than assuming the entire privilege-escalation system is broken.

The more you practice these commands in a virtual machine, the more confidently you will troubleshoot Linux systems in system administration, cybersecurity, and kernel engineering.

Keep learning. Keep testing. Understand what Linux is doing under the hood.