Root in FC-10

[Mikkel L. Ellertson]

R. G. Newbury wrote:
> Mikkel L. Ellertson wrote:
> 
>>After all, we do not want to see Linux systems that are as insecure
>>as Windows systems are by default. Running as root all the tine
>>defeats most of the security of a Linux system.
> 
>>Mikkel
> 
> Well how *exactly* does running *as root* defeat *most* of the security
> of a linux system. Sorry but that is BS.
> Virtually any exploitable point allows an escalation by way of further
> exploit. If and only if, it is possible to ensure (to 100%) that no
> exploit can be escalated to provide root level privileges, is it
> reasonable and logical to claim that not using root, is "safer" than
> using root. It has never been explained to my satisfaction how the
> supposed 'sandbox' of being user in fact adds any extra security to the
> computer.
> G
> 
> 
Let me see  - most of the permission checks just went out the window
- root can read and write most of the files on the system. A normal
user can not modify executable files except for the ones they have
write permission on. If you are running as root, there is no need to
find a exploit that gets you escalated to root permissions - you are
starting there already.

Every one in a while someone finds a bug in a web browser that will
let them run code on the computer connecting to their computer, or a
way to make the user's mail program do the same thing. Now, if they
can only affect the user's own files, they can not trash the entire
system.

Think of it this way - is wearing a seat belt in a car safer? It
will not protect you 100% of the time. does that mean you shouldn't
wear one?

Another way to look at it is that you should not look your house or
car, because the locks are not going to protect you house or car
100% of the time.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20081206/befdc76b/attachment-0001.sig>