Re: Comparing -k and -K

On Tue, 27 Dec 2022 16:33:11 -0500, Jason Franklin wrote:

> In my ~/.bash_logout file, I would like to do something similar to:
>
>   if [[ -x /usr/bin/sudo ]]; then
>     /usr/bin/sudo -k
>   fi
>
> The documentation above suggests that "-k" was added to support revoking
> "sudo" permissions in a ~/.logout file or similar.

That is correct.

> However, from reading, it seams that "-K" may be better for this purpose
> since it removes the cached credentials entirely. Is this correct?
>
> If I want to revoke permissions in my ~/.bash_logout file, which one of
> these options is recommended?
>
> Is "-K" better/stronger than "-k"?

It depends what you want to achieve.  The cached credential file
generally holds multiple credentials.  For example, there is a
seperate entry for each terminal the user logged in to.  Running
"sudo -k" will invalidate the credentials for the current terminal
session but will not affect other sessions.  Running "sudo -K" will
remove the entire credential file so it affects all sessions.

 - todd
____________________________________________________________
sudo-users mailing list <[email protected]>
For list information, options, or to unsubscribe, visit:
https://www.sudo.ws/mailman/listinfo/sudo-users