sudo proxychains vs. proxychains sudo: Why Order Matters

These commands do not have the same execution boundary:

proxychains4 sudo command
sudo proxychains4 command

Proxychains-ng arranges for a library to be preloaded into the target program. On Linux, executing a set-user-ID program such as sudo invokes loader security rules that remove relevant library-loading variables before sudo can preserve them.

Consequently, “preserve more environment” is not a reliable repair for putting sudo inside the wrapper. The sudoers manual explicitly describes variables such as LD_* being removed before sudo begins.

If a command genuinely requires the target account, start the wrapper in that authorized context. Then check which configuration it reads: sudo may change HOME, PATH, and the applicable per-user file. A working unprivileged invocation does not establish that root selected the same proxy list.

Prefer the program's native proxy interface when it offers one. That avoids depending on interception for a request the program already knows how to route.

Also keep proxychains' coverage limits in view. Its startup message proves that the wrapper started; it does not establish that raw packets, unsupported calls, or a separately launched existing application process used its library. Confirm the network operation you intended to proxy, rather than treating root privilege as evidence that every operation was intercepted.