this post was submitted on 05 Dec 2023
946 points (98.1% liked)
linuxmemes
21172 readers
1074 users here now
Hint: :q!
Sister communities:
- LemmyMemes: Memes
- LemmyShitpost: Anything and everything goes.
- RISA: Star Trek memes and shitposts
Community rules (click to expand)
1. Follow the site-wide rules
- Instance-wide TOS: https://legal.lemmy.world/tos/
- Lemmy code of conduct: https://join-lemmy.org/docs/code_of_conduct.html
2. Be civil
- Understand the difference between a joke and an insult.
- Do not harrass or attack members of the community for any reason.
- Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
- Bigotry will not be tolerated.
- These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
3. Post Linux-related content
- Including Unix and BSD.
- Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of
sudoin Windows. - No porn. Even if you watch it on a Linux machine.
4. No recent reposts
- Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.
Please report posts and comments that break these rules!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Why?
Files from user: nano
Files from root: sudo nano
Files from another user: sudo nano (and if new sudo chown after)... ๐
Never had any problems with this in over 10 years... ๐ ๐
As mentioned, to prevent running your text editor with root permissions. It's just security optimization
Let me rephrase my question:
Why would I not want to open nano as root?
No offense, but that sounds like more OCD behavior. ๐ I don't need or want protection against myself, and I even loath the whole "that's not how you're supposed to do it"-mentality of linux (where when commands know very well what you want, instead of doing it, just tell you you forgot something). ๐
It's probably to protect against any potential security vulnerabilities in the text editor program itself, not to protect you from yourself.
Wouldn't that logic count for anything, including sudo itself?
Sure, but sudo is specifically designed with security in mind as a security program, whereas text editors are not (although I am more likely to trust vim than vscode). Running a malicious program as the user and not as root can help mitigate the impact it could do, even though it will still be able to do a lot as a user.
You assume this malicious code is lame enough not to gain root itself with a modified su.
What do you mean get root itself with a modified su? A program that has been run as a user cannot just get root permissions, that's called a privilege escalation attack and is a serious vulnerability in the kernel which gets fixed quickly when found.
Any attack is usually non-intended vulnarabilities. Same argument applies to any software, like nano, if it can open doors to your system.
Of course it applies to any software, but some programs are more vulnerable than others. For example, when you want to have cryptography in your program, you use an established library, not write the algorithms yourself, because those libraries were written with security in mind (i.e. have protections against different kinds of attacks, for example, side channel attacks, in addition to being implemented properly). The whole point is to minimize the surface of attack, so that your system is more secure. And one way of doing so is to not give root permissions to programs that don't need it (such as text editors like nano).
Yeah, well, as you said: it's probably fixed by now, but I used to have a universal su that would work on any armv7 linux (so basically every phone back then, but also on my armv7 little laptop I had at the time...) with which I was able to easily root any phone by putting it in /data/local and making it bootable, then using full path to move any Android root files in place (though I did also just copy that su itself to /system/bin for root on cheaper phones sometimes, which is just playing with fire as it basically makes any root action unseen and allowed. ๐). That did work for years though, but that's probably cause Android minimizes the linux and never actually updated the kernel so much, and the laptop's flashed OS was something altered with also very little updates. And ARM was still quite new to the public too. ๐คทโโ๏ธ
I remember I came across it in the rooting package for my Kindle Fire and only found out it could do that by accident,... ๐ It couldn't change user, though, it had only 1 use without parameters, which resulted as if you do a 'sudo su' if you remove the sudo password-requirement.
Hence why I used the example. I wasn't being limitative to it, though. There's so many things that could screw you if it has a vulnerability, if it happens I very much doubt it'll be through nano, though.
You can say that just about anything.
sudo grub sudo boot sudo root=/dev/disk/linux sudo kernel-6.1.image sudo init sudo elogind sudo xterm sudo bash sudo nano
Again, like I replied to the other comment, most of the programs you need root for are designed with security in mind and are inherently more secure and have less vulnerabilities than a non security focused program (that is not to say that it is impossible for a security program to have vulnerabilities -it certainly occurred before and keeps occurring- they just have a lot fewer). But even if you need root permissions for a non security focused program, you still shouldn't let any program have it, the whole point is to minimize the surface of attack.