[dayglored]

Oh, I knew that root is above administrative users (and that there is no user called Administrator unless you feel like making one). I think of it like this:

• Users with sudo priv can become root.
• Regular user accounts have no sudo priv.
• Administrative user accounts have sudo priv, and have certain other admin rights, but normally operate as regular users. For example, I'm an admin user on my Mac but I can't read /etc/sudoers unless I invoke sudo.
• The user "root" -- uid 0 -- can do anything that can be done. And there's only one "root" user -- admin users with sudo can change their effective uid to 0 (/etc/sudoers "%admin ALL=(ALL) ALL"), but there are not multiple "root" users.

What I meant by "What am I not understanding here?" was more like... "What's the big deal, because anyone with admin access can sudo already."

[Swordmaker]

What I meant by "What am I not understanding here?" was more like... "What's the big deal, because anyone with admin access can sudo already."

You got it. . . but in OS X one of those admin users can be first to create the ROOT user account—it's turned off by default—and give it a user name and password known only to him, at which point, any one trying to use sudo will encounter a requester demanding entry of that ROOT account name and password before it continues to do anything.

That admin who created the account can log in as the Super User and act as God of this computer and the other admins could do nothing to take back control. . . well there are ways, but drastic using the restore process if the Super User hasn't remembered to protect that file as well. This vulnerability gives them a backdoor to mount a mutiny where they can essentially change anything.

I've only run into one Mac where a user created a Super User account, an ex-Windows' user who thought he'd need it for housekeeping tasks, and then promptly forgot his fairly complex password! I had to restore the system to factory to get rid of it. Luckily he had a backup of his data files.

[Swordmaker]

Oh, as I understand it, the Super User can, if he chooses, change the Super User group to allow more than one member, but the default is currently just one.