Living Under a sudo Grant: Recover On-Call

You are 'student', the on-call operator — and this time you are NOT root. Your prompt ends in $. When you were put on the rotation, your access was scoped: you were given sudo for exactly the tasks on-call needs, and nothing else. That is least privilege, and living under it is a daily-driver skill most people never actually practice.

Right now widgetd's log is full and the disk is filling: /var/log/widgetd/widgetd.log has grown huge and needs rotating. Try to fix it directly and you'll hit a wall — that log is root-owned and you can't write, truncate, or delete it, and you can't create files in its directory. You don't have root and there's nobody to escalate to.

So find out what you CAN do. Run sudo -l to see exactly which command(s) you're allowed to run as root — you'll find the on-call team ships a sanctioned rotation tool for precisely this. Use it to rotate the log. Then notice what you still can't do (edit the tool, read root's files, run other commands as root): that boundary holding is the whole point.

This is the real sudo workflow: hit EPERM, run sudo -l to discover your grant, escalate for the one sanctioned command, drop back.