R. G. Newbury wrote: > Mikkel L. Ellertson wrote: > >>After all, we do not want to see Linux systems that are as insecure >>as Windows systems are by default. Running as root all the tine >>defeats most of the security of a Linux system. > >>Mikkel > > Well how *exactly* does running *as root* defeat *most* of the security > of a linux system. Sorry but that is BS. > Virtually any exploitable point allows an escalation by way of further > exploit. If and only if, it is possible to ensure (to 100%) that no > exploit can be escalated to provide root level privileges, is it > reasonable and logical to claim that not using root, is "safer" than > using root. It has never been explained to my satisfaction how the > supposed 'sandbox' of being user in fact adds any extra security to the > computer. > G > > Let me see - most of the permission checks just went out the window - root can read and write most of the files on the system. A normal user can not modify executable files except for the ones they have write permission on. If you are running as root, there is no need to find a exploit that gets you escalated to root permissions - you are starting there already. Every one in a while someone finds a bug in a web browser that will let them run code on the computer connecting to their computer, or a way to make the user's mail program do the same thing. Now, if they can only affect the user's own files, they can not trash the entire system. Think of it this way - is wearing a seat belt in a car safer? It will not protect you 100% of the time. does that mean you shouldn't wear one? Another way to look at it is that you should not look your house or car, because the locks are not going to protect you house or car 100% of the time. Mikkel -- Do not meddle in the affairs of dragons, for thou art crunchy and taste good with Ketchup!
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-list mailing list fedora-list@xxxxxxxxxx To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
