What does sudo stand for? The answer changed while nobody was looking

A DEC VAX 11/780 — the class of shared departmental machine sudo was invented to police: many users, one root, and a log of who did what. Photo by Takuya Oikawa, CC BY-SA 2.0.

Ask a room of engineers what sudo stands for and most will say superuser do without hesitating. That was true in 1980. It is not quite true anymore, and the drift is the interesting part: the command outgrew its own name, and the name quietly got reinterpreted to keep up. The official project page today spells it su "do", and since su itself was redefined in the man pages from superuser to substitute user, the modern expansion of sudo is substitute user, do. Same four letters, new etymology, no announcement.

Who wrote sudo?

sudo was written around 1980 by Robert Coggeshall and Cliff Spencer at the Computer Science Department of SUNY Buffalo. The problem it solved was mundane and eternal: several people shared a machine, some of them occasionally needed root, and handing out the root password to everyone was obviously terrible. sudo let a named user run a single command with superuser privileges, using their own password, while the system logged who did what.

At the time the name was honest. The tool did exactly one thing: it let you do something as the superuser. su, its older sibling from the earliest Unix, was likewise commonly read as superuser — you ran su, you became root.

Coggeshall later brought the code to the University of Colorado Boulder, where it was substantially reworked between 1986 and 1993. One of the people doing that reworking was a staffer named Todd C. Miller. Miller has now maintained sudo since 1994 — more than three decades of stewardship of a tool that ships in effectively every Linux distribution and macOS. One maintainer, thirty-plus years, billions of installs. The xz backdoor discourse of 2024 was about exactly this shape of dependency, and sudo is one of its oldest examples with a happier trajectory.

What does sudo actually stand for?

Three answers, all defensible, in chronological order:

• superuser do (1980) — the original reading, when the tool could only elevate to root, and su meant superuser.
• su "do" — the spelling the sudo project itself uses: sudo is su, plus do.
• substitute user, do — the modern reading. sudo grew the -u flag, which runs a command as any user, not just root. sudo -u postgres psql elevates you sideways, not up. In parallel, the su man pages redefined su as substitute user. Both halves of the old etymology moved, so the expansion moved with them.

The drift is the same pattern as grep, where the name preserves the tool's lineage rather than its function: the letters froze while the meaning underneath kept developing. Nobody renamed sudo when it stopped being only about the superuser. The name is a fossil with a living animal inside.

The file you edit with a safety net

sudo's entire policy — who may do what, as whom, on which machine — lives in /etc/sudoers, and the file is famous mostly for the ways it hurts people. It has its own editor wrapper, visudo, which exists for one reason: sudoers is parsed strictly, and a syntax error in it can mean nobody can sudo anymore, on a machine where fixing the file requires sudo. visudo checks the syntax before saving, standing between you and the oldest lockout in Unix. The file's grammar (aliases, host specs, NOPASSWD: tags, the %wheel group inherited from older Unix tradition) is a small language everyone learns exactly once, in a hurry, usually while hardening a fresh server.

And it is the source of computing's most famous empty threat. Type a sudo command without being authorized and you get the immortal line: "This incident will be reported." Reported to whom? By default, sudo sends mail… to root, on the same machine — an alert about you, delivered to a mailbox that is usually unread, on a box you may be the only user of. Somewhere in the man pages it made sense; in practice it is the sternest sentence ever printed to no audience whatsoever, and it has been scaring juniors straight for forty years anyway. Security theater with a 100% conversion rate.

Baron Samedit, or: thirty lines from 1980 meet 2021

In January 2021, Qualys disclosed CVE-2021-3156, promptly nicknamed Baron Samedit: a heap overflow in sudo's command-line escaping, triggerable via sudoedit -s and a trailing backslash. Any local user — no sudo rights required — could become root on essentially any default-configured Linux system. The bug had been in the code since 2011, sitting unnoticed for about a decade in one of the most security-audited programs in existence.

The lesson cuts deeper than one CVE. sudo is the privilege boundary itself — the program whose whole job is deciding who gets to be root — written in C, carrying decades of features (the man page runs to thousands of lines), maintained by one steward. Todd Miller patched it within days, as he has patched everything since 1994. But Baron Samedit made the structural point unignorable: the fence around root was itself a large, old C program, and large old C programs have heap overflows. Which brings us to the succession.

The successors circling

Two serious contenders now aim at sudo's throne, from opposite philosophies:

• doas (OpenBSD, 2015) attacks the size. Ted Unangst wrote it after concluding sudo had grown into a system nobody could hold in their head; doas's config is a few readable lines (permit persist mart as root), and its man page fits on a screen. The pitch: a privilege boundary should be small enough to audit over coffee.
• sudo-rs attacks the language. Started in 2022 by the Internet Security Research Group's Prossimo project and maintained by the Trifecta Tech Foundation since 2024, it reimplements sudo and su in Rust, making Baron Samedit's entire bug class — memory corruption — unrepresentable. It is not a fringe experiment: Ubuntu 25.10 ships sudo-rs as the default sudo, meaning millions of machines now type the same four letters into a completely different program.

Note what both keep: the name, the muscle memory, the sudo incantation itself. Ubuntu did not ask users to learn a new word; it swapped the animal and kept the fossil.

Why sudo won

The alternative model — everyone who needs root gets the root password — fails on the audit trail. With su, the log says root did it. With sudo, the log says which human did it, at what time, running what command. That single property is why sudo moved from a Buffalo campus convenience to the default privilege boundary of the Unix world, why "sudoers" became a file every sysadmin has broken at least once, and why the word escaped the terminal entirely — sudo make me a sandwich is a joke that only works because everyone in the room has typed the incantation.

It also explains the tool's longevity through the containerization era: even in a world of ephemeral machines, who elevated, when, to do what remains the question every incident review asks first.

The name will outlive the binary

Like grep, like k8s, the name is now more durable than any implementation detail. The succession is already underway — a whole distribution now runs a different program under the same four letters, and most of its users will never notice. That is the endgame of every etymology in this series: the implementation is mortal, the incantation is not. The four letters became the category, and the category no longer needs the original.

sudo: born ~1980 at SUNY Buffalo as "superuser do," officially "su do," currently best read as "substitute user, do." The rare acronym that got more accurate by being reinterpreted.