How to Check Your Sudo Privileges and Allowed Commands in Linux Using sudo -l

In multi-user Linux environments and managed server deployments, permissions are strictly regulated to maintain operational security. When working as a system administrator, DevOps engineer, or developer, attempting commands requiring elevated root privileges without knowing your exact security delegation can result in command errors or security alerts. Rather than blindly running root-level commands or attempting to open the restricted /etc/sudoers file, Linux provides a clean command-line flag—sudo -l—to inspect your assigned privileges directly.

Why Inspect Sudo Privileges Directly?

The sudo security subsystem relies on rules defined in /etc/sudoers and modular drop-in configurations stored under /etc/sudoers.d/. Standard non-root users are explicitly blocked from reading these files to prevent unauthorized privilege mapping. The sudo -l (or --list) parameter queries the sudoers authentication database on your behalf, authenticates your account, and outputs only the exact commands, scripts, directories, and environmental limits permitted to your user or group.

How to Run sudo -l to List Your Privileges

To inspect the administrative rights assigned to your current shell session:

1. Open your terminal application or establish an SSH connection to your remote Linux host.
2. Execute the list privileges command:

   sudo -l

3. When prompted, enter your current account’s password:

   [sudo] password for alex:

4. The terminal will print your default sudo environment specifications followed by the exact run-as authorizations configured for your user.

Understanding the sudo -l Output

The terminal output typically consists of two primary sections: Defaults and User Specification.

1. Default Environment Directives

At the top of the output, you will see a list of global security parameters governing how sudo behaves for your shell session:

Matching Defaults entries for alex on webserver-01:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

• env_reset: Clears volatile user environment variables to prevent privilege escalation via injected library paths (such as LD_PRELOAD).
• secure_path: Specifies the restricted search path used when locating and executing administrative binaries.

2. Permitted Commands and Restrictions

Beneath the defaults, sudo prints the exact rules matching your user or supplementary groups:

User alex may run the following commands on webserver-01:
    (ALL : ALL) ALL

The standard format follows (RunAs_User : RunAs_Group) Command_Spec:

• (ALL : ALL) ALL: Indicates complete administrative autonomy. You can execute any command as any user or group across the entire system.
• (root) /usr/bin/systemctl restart nginx, /usr/bin/journalctl: Indicates granular delegation. You are only authorised to restart the Nginx web service and view system journals as the root user. Attempting any other administrative action will be rejected.
• NOPASSWD: /usr/bin/apt update: Indicates that you can execute the specified command with elevated rights without being prompted to enter your password.

Checking Sudo Rights for Other Users (Administrators Only)

If you possess full administrative permissions and need to audit access delegations for a colleague or service account without switching sessions, you can specify the -U flag:

sudo -l -U developer_user

This prints the exact sudo permissions configured for developer_user, allowing administrators to verify security policies and ensure the principle of least privilege is rigorously maintained.

Troubleshooting Common sudo -l Messages

• User is not allowed to run sudo on this host: Your user account is not registered in /etc/sudoers or member of the sudo or wheel groups. Contact your system administrator to request access.
• Authentication failure: Ensure you are entering your user password correctly. Entering an incorrect password three times will temporarily lock the prompt and log an event in the system audit records.