Linked by Thom Holwerda on Tue 28th Feb 2012 23:11 UTC
Linux Linus Torvalds on requiring the root password for mundane tasks. "So here's a plea: if you have anything to do with security in a distro, and think that my kids (replace 'my kids' with 'sales people on the road' if you think your main customers are businesses) need to have the root password to access some wireless network, or to be able to print out a paper, or to change the date-and-time settings, please just kill yourself now. The world will be a better place." Yes, it's harsh (deal with it, Finns don't beat around the bush), but he's completely and utterly right. While there's cases where it makes sense to disable certain settings (public terminals, for instance), it is utterly idiotic that regular home users have to type in their root password for such mundane tasks.
Thread beginning with comment 508874
To read all comments associated with this story, please click here.
ugghh!
by TechGeek on Wed 29th Feb 2012 04:35 UTC
TechGeek
Member since:
2006-01-14

I know most people thinks its a hassle to type in the root password, but seriously, how many times do you configure printers? Or the time? There were legitimate security concerns for everything that requires root. Once you unlock these services from root, they become vehicles for malicious attacks on the system. Remember, one of the benefits of Linux is that everything runs as its own user. That means by default, all Linux boxes are multiuser whether you like it or not.

Reply Score: 4

RE: ugghh!
by ndrw on Wed 29th Feb 2012 06:25 in reply to "ugghh!"
ndrw Member since:
2009-06-30

I know most people thinks its a hassle to type in the root password, but seriously, how many times do you configure printers?


It's a hassle to obtain the root password, which shouldn't be required for routine stuff in the first place. In fact obtaining a root password is often impossible and the user is then left with a desktop crippled to the point of being unusable (seriously, I prefer using Windows XP with Linux inside a VM than a system like that).

Connecting a printer, mounting a filesystem, connecting to a network, installing some non-privileged apps or bugfix upgrades of privileged ones - these are all legitimate user tasks on decentralized systems (which is almost all of the current deployments), none of them should require "I own the world" type of permission.

Reply Parent Score: 3

RE[2]: ugghh!
by oiaohm on Wed 29th Feb 2012 08:09 in reply to "RE: ugghh!"
oiaohm Member since:
2009-05-30

You are not thinking this through.

Virus and Malware you don't want messing with those settings.

Policykit is design for the particular problem. Because it approve applications to do things.

sudo becomes unworkable as so as you try filtering to applications.

"I own the world" type of permission. Is what the problem is. Policykit provides another set of permissions. This application is trusted todo the following. And only this app. Even if the app is trusted it then asks the user the first time they use that app if they do wish to use its privileged options.

This is creating true secuirty by obscurity. Because attacker has to know what application you use for task not to be noticed.

Reply Parent Score: 2