Sudo-rs is a memory safe implementation of sudo and su written in Rust.
The project addresses the security vulnerabilities inherent in the original sudo codebase by rewriting the tool in Rust, a language that eliminates entire classes of memory safety bugs. Rather than attempting to patch the existing C implementation, sudo-rs takes a safety-oriented approach by building the functionality from scratch with memory safety as a core design principle. This allows it to provide the core privilege escalation and command execution features users expect while reducing the attack surface from memory corruption vulnerabilities.
Sudo-rs suits environments where memory safety is a priority and where the core sudo and su functionality is sufficient for your needs. The tool is actively maintained and has undergone two independent security audits. However, some features present in the original sudo may still be unimplemented or not planned, so you should verify that your required functionality is available before adopting it. The project is currently targeted at FreeBSD and Linux-based operating systems. Many Linux distributions package sudo-rs with modified command names such as sudo-rs, sudoedit-rs, visudo-rs, and su-rs to avoid conflicts with the original sudo, though some distributions like Ubuntu have made it the default sudo implementation.
The project maintains an active issue tracker where users can request missing features and report usability bugs. Security vulnerabilities can be reported through a dedicated security page. The tool has received two formal security audits, with audit reports publicly available in the repository documentation. The project accepts bug reports and feature requests through standard channels and provides a frequently asked questions document to address common concerns.
