LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Fedora (https://www.linuxquestions.org/questions/fedora-35/)
-   -   Petition to Fedora to stop trying to protect us from "ourselves" (https://www.linuxquestions.org/questions/fedora-35/petition-to-fedora-to-stop-trying-to-protect-us-from-ourselves-683605/)

EzusChrist 12-01-2008 10:00 PM

Quote:

Originally Posted by John VV (Post 3360099)
Raveolution as someone else has said .There is almost NO reason to login as ROOT ...
su -
root pass
nautilus --no-desktop[/code]
up and running as root with a gui and still logged in as user

---------------------------------------------------------------------
Raveolution, we can never win 'cause there will always be comments like that- you've clearly stated that you understand the taboo of logging in as root, but what if the reason is "just cause I wanna", or I just don't feel like typing "su" today. Maybe I just wanna be king and what I say goes. I will never understand the benefit of not allowing it; sure you can get around it by editing a text file or if your really nuts, changing the source, but why put the effort of writing such a restriction into the o.s. ?-and I'm sure I'll get blasted for this, but please feel free because I would really like to understand the logic behind it. The first time I was introduced to Linux, I was warned "be VERY careful when logged in as root, because you have a lot of power", and that was in runlevel 3,no gui- this was more than enough warning for me to understand. When the nag windows started; a little annoying, but ok, but now in Fedora 10 you can not log into x as root at all! it says "cannot authenticate user", which is a lie by the way... but why? seriously! Like Raveolution said- "I don't need you to hold my hand"

estabroo 12-01-2008 11:14 PM

You should still be able to run X as root, just flip to an unused tty with a command like ctrl-alt-f2, log in to the terminal as root (might need to first add that tty to the secure list), and then
Code:

startx -- :1
That'll fire up a new X server on the second vty running as root, you can flip back to your original X by doing ctrl-alt-f7 (and then back again ctrl-alt-f8)

SqdnGuns 12-02-2008 12:16 AM

Find another suitable Distro for yourself.

x_terminat_or_3 12-02-2008 12:51 PM

Re: EzusChrist

The main reason is because the more programs you have running as root, the easier it is for malware to exploit your system. It is the single main reason why Viruses, and other malware, and exploits, know such great success on the Windows platform.

Say, you're running your web browser as root, chances are this will be Firefox, and a great many exploits exist for FireFox, not to mention the flash plugin. If they are able to exploit your Firefox, they instantly gain access to your entire system. If you had run Firefox as a `normal' user instead, they'd be able to mess with that user's files and programs, but would not be able to make system-wide changes.

Like I said previously, I'm not interested in starting a flame war, but my personal feeling is that, as a rule, one should not run their desktop as root.

We live (mostly) in an (apparent) free world, so by al means disagree, as long as you recognise my right to feel this way.

EzusChrist 12-02-2008 03:29 PM

RE:x_terminat_or_3
 
Please don't misunderstand me, I hear ya when it comes to the security issue- and I do not disagree with you by the way- about logging in as root, as a matter of fact I am going to use estabroos' suggestion. My issue is putting effort into writing restrictions into the source; wouldn't you agree that a nag window here and there is enough (if you don't already know) to make you aware of the risk you are taking. I have nothing against your view, it just seems a bit much, "vista like" if you will, to put effort into disallowing it. Is it that important to keep me from putting myself at risk? Might I add, that I love Fedora, I have been using it for some time now and I really like fc10 so far and don't plan on switching. I have it installed as a dual boot system (with the Vista that came with it) on my laptop and with XP on my home PC, both with Fedora as the default os. That being said, with all due respect to x_terminat_or_3, and to keep with the theme of the thread I am in favour of the Petition to Fedora to stop trying to protect us from "ourselves"

Tim356 12-03-2008 05:23 AM

Quote:

Originally Posted by x_terminat_or_3 (Post 3362024)
Re: EzusChrist

The main reason is because the more programs you have running as root, the easier it is for malware to exploit your system. It is the single main reason why Viruses, and other malware, and exploits, know such great success on the Windows platform.

Say, you're running your web browser as root, chances are this will be Firefox, and a great many exploits exist for FireFox, not to mention the flash plugin. If they are able to exploit your Firefox, they instantly gain access to your entire system. If you had run Firefox as a `normal' user instead, they'd be able to mess with that user's files and programs, but would not be able to make system-wide changes.

Like I said previously, I'm not interested in starting a flame war, but my personal feeling is that, as a rule, one should not run their desktop as root.

We live (mostly) in an (apparent) free world, so by al means disagree, as long as you recognise my right to feel this way.

+1

My hat goes off to x_terminat_or_3. This post is all that needs to be quoted the next time someone asks why they can't run as root. It has nothing to do with holding your hand or not trusting you as a 30 year old who has raised kids. It's protecting you (and the distro's reputation) from exploits.

Answer me this: what can't you do logging in as a standard user? Every admin task will prompt you for a password - big deal?

adrianx 12-05-2008 07:25 AM

The so-called restriction doesn't bother me at all.

I know far too many people that seem to forget that their computers are connected to the Internet. Your computer is *not* operating in complete isolation. So, when people say that logging in to X as root is safe because they know what they're doing, they are actually contradicting themselves, imo.

Hitboxx 12-05-2008 08:30 AM

I don't have a problem either. Ever since I've been using Linux, all I ever did was add a custom button to the panel with the command 'sudo nautilus --no-desktop' to do whatever root operations I need.

estabroo 12-05-2008 03:37 PM

One thing that is kind of funny about this whole discussion is X runs a root regardless of who you log in as, its a suid program. Just do a ps aux | grep X and see if it isn't root that is running it. Now granted that's just X, all your other programs your X session will be run as who you logged in as.

x_terminat_or_3 12-05-2008 03:42 PM

Quite right, and GDM, and KDM also run as root. It's because they need to be able to start the initial program (kde,gnome,...) as a different user, and only root has that power.

lazlow 12-05-2008 05:17 PM

While I am no fan of the current root solution, I think Fedora has bigger fish to fry. In particular I am speaking of the HUGE backlog of bugs. There are still a ton of bugs that were introduced in F7 (and later) that are still with us in F10. RH itself has recognized the shortfall (RH relinquished control of Fedora shortly before FC6's release) and now has added a lot of paid developers (more than have ever worked on Fedora before). Hopefully these new paid devs will succeed at clearing up this backlog, where the Fedora leadership has ignored the problem in favor of new features.

Raveolution 05-10-2009 10:58 AM

Quote:

Originally Posted by Tim356 (Post 3362837)
+1

My hat goes off to x_terminat_or_3. This post is all that needs to be quoted the next time someone asks why they can't run as root. It has nothing to do with holding your hand or not trusting you as a 30 year old who has raised kids. It's protecting you (and the distro's reputation) from exploits.

Answer me this: what can't you do logging in as a standard user? Every admin task will prompt you for a password - big deal?

Lemme ask you this, then... why bother with Linux in this case when you can deal with Vista? Their whole thing is prioritizing the protection of their brand/"distro"'s reputation from exploits, over the user's freedom.

The Linux I remember was not about "justify why you're doing this". We're starting down a really nasty road.

Besides, from what I've learned, IMHO, Linux exploits escalate to Root by stuff like smashing stacks. If that hacker wants in and he compromises a user account and he finds an exploit in X, KDM or GDM, he's not going to be restricted, but you are.

soleilarw 06-01-2009 04:57 PM

It's OK if someone wants full control on his/her own Linux box. It's a bit strange to switch a distribution just because of a single tool. As a matter of fact, wanting control should be paired with knowledge. Not knowing how to make a tool behave as one wants it to behave is often a good sign that one is messing with something that is not fully understood. In such a case it might even be better to restrict access instead of allowing disaster.

Linux Archive

PTrenholme 06-02-2009 11:29 AM

Somewhat off-topic, but a "heads-up" if you move to F11
 
Quote:

Originally Posted by estabroo (Post 3361299)
You should still be able to run X as root, just flip to an unused tty with a command like ctrl-alt-f2, log in to the terminal as root (might need to first add that tty to the secure list), and then
Code:

startx -- :1
That'll fire up a new X server on the second vty running as root, you can flip back to your original X by doing ctrl-alt-f7 (and then back again ctrl-alt-f8)

I've been playing with the F11 Preview for a while now, and I've noticed that the first X-server is connected to tty0 instead of tty7. Thus you need a Ctrl-Alt-F0 to get back from a startx -- :1.

For what it's worth, here's an untested "generic" .Xclients-default for starting you with whichever window manager type you wish to specify in your /etc/sysconfig/desktop file.
Code:

$ cat .Xclients-default                                     
#!/bin/bash                                                                   
#                                                                             
# Set the default display manager to KDE
#
# Code modeled on /etc/X11/xinit/Xclients                                     
#                                                                             
DefaultManager=KDE                                                           
#                                                                             
# Read the preferred display manager name from /etc/sysconfig/desktop if possible                                                                             
# otherwise use the default                                                   
#                                                                             
if [ -x /etc/sysconfig/desktop ];                                             
then                                                                         
  . /etc/sysconfig/desktop                                                   
else                                                                         
  DISPLAYMANAGER=$DefaultManager                                             
fi                                                                           
[ -z $DISPLAYMANAGER ] && DISPLAYMANAGER=$DefaultManager                     
#                                                                             
# Get the window manager executable name for the specified DISPLAYMANAGER value
#                                                                             
case $DISPLAYMANAGER in                                                       
  KDE)                                                                       
    WM="startkde";;                                                           
  GNOME)                                                                     
    WM="gnome-session";;                                                     
  XFCE)                                                                       
    WM="startxfce4";;                                                         
  KARMEN)                                                                     
    WM="karmen";;
  ICE)
    WM="icewm";;
  OPEN*)
    case $DESKTOP in
      GNOME)
        WM="openbox-gnome-session";;
      KDE)
        WM="openbox-kde-session";;
      *)
        WM="openbox";;
    esac;;
  METACITY)
    WM="metacity";;
  TWM)
    WM="twm";;
  WMAKER)
    WM="wmaker";;
  FLUXBOX)
    WM="fuxbox";;
  FVWM)
    WM="fvwm";;
  *)
    WM="startkde";;
esac
#
# Locate the window manager and start it
#
manager=$(which $WM)
[ -n "$manager ] && [ -x "$manager" ] && exec $manager
#
# If we get here the specified window manager could not be found
#
exit 1

(The code's untested because I find it more convenient to use the .Xclient-<hostname>:<screen> form so startx -- :<screen> starts me in a specific window session type.)

Raveolution 02-19-2010 08:14 PM

You know why I hate these restrictions against running as root?

I can't even edit .doc files on mounted usb drive partitions because I have to have root permissions to do that. To wit:

OpenOfficeWriter tells me: "Object not accessible. The object cannot be accessed due to insufficient user rights" when I'm a user, but as root I can edit it, no problem. Argh.


All times are GMT -5. The time now is 01:40 AM.