Is it more dangerous to connect to the net as root?

Question

If I make some kind of tcp connection to the net as root, is that less safe then making the same tcp connection as a normal user?

I have been suspecting for a while that by making a connection as root, it opens up the possibility for a hacker on the other end to come into my system as root.

But if I connect as a normal user, then they might be able to come in as that user, which would be less of a security risk as they don't have root privileges.

Am I right?

Answer 1

This is does not matter whether you create tcp connection as a root or regular user. Socket creation is a kernel business and TCP connections is a Transport Level of OSI model

But software you use (Application level) can contain software vulnerabilities and hacker can exploit them. So the basic recommendation is not to execute application as with a root privileges.

Answer 2

Root or non-root, this is a matter local to your machine. It does not change what the peer receives on the other side of the connection.

If the software you use for the connection has a serious vulnerability which allows the remote server to hijack your application, then opening the connection as root means that the attacker will obtain a root process on your machine. On the other hand, if you open the connection as a non-root user, then the attacker obtains a non-root process. It does not matter much in practice: if the attacker can run arbitrary code under your UID (that you use to do everything on your machine), then you are doomed anyway.

The usual mantra of "do not run as root" is partly a damage containment feature, but mostly it is old lore from times where a typical Unix system was used by dozens of simultaneous users; that was the mainframe model. This model is of limited applicability to what we do nowadays, with machines which are de facto single user systems. You should still run your process as non-root, if only for the sake of Tradition (Tradition is important in the Unix world).

If you really want an effective layer of isolation, run your network process in a sandbox: a chroot environment, possibly a virtual machine (that's what Qubes does).