For personal linux on my personal notebooks, I've usually set my environment to autologin as root even under X or lower runlevels. I've found my workflow is very pleasant and fast, without any cumbersome need to type su or sudo or being asked by keyring or auth or something.

So far I've never had any problem with it, so why are most people freaking out about it? Is the concern overrated? Of course this assumes the user knows what they are doing and doesn't really care about system reliability and security issues.

  • 4
    why run as root? if you really just don't want to type sudo I'd suggest editing /etc/sudoers and adding some commands as nopasswd (not all of them) then in your ~/.bashrc (or alias file) add aliases to sudo command. This is still probably not a good idea but it will limit the damage you can do, or have done to you. Aug 23, 2010 at 13:13
  • 11
    The level of hostility in this thread is a little worrisome; it's a legitimate question. Yes, running as root all the time is a bad idea, but there's no need to flip out about it Aug 24, 2010 at 21:52
  • 5
    @Mrozek: Agreed. Now, I'd never give the OP root password to any system I had control over, but trashing one's system by typing the wrong thing can be very educational. Perhaps the OP writing "So far I've never had any problem with it" will learn something useful, like the fact that things can happen for the first time. Aug 24, 2010 at 21:58
  • 2
    I think this sums up why not: unix.stackexchange.com/questions/502/…
    – Alex B
    Aug 25, 2010 at 8:38
  • 3
    To bring in a car analogy: It's like driving without a seat belt. Possible, but potentially deadly.
    – invert
    Aug 25, 2010 at 14:35

10 Answers 10


For the same reasons why each daemon should have minimal rights. Apache can run as root. It is designed to perform one task and surely nothing bad can happen?

But assume apache is not bug-free. Bugs are discovered from time to time. Sometimes it can even be arbitrary code execution or similar. Now with apache running as root, it can access anything — for example it can load a rootkit into kernel and hide itself.

On the other hand, writing a user-level rootkit is very hard. It has to override different programs (like ps) inside /home, which can raise suspicion due to the extra disk space used. It might not know the exact configuration and forget to include e.g. gnome-system-monitor therefore exposing itself. It has to cover bash, tcsh and any shell you happen to use (to start itself). It would have to work with different configurations instead of 'simply' overriding a bunch of callbacks.

Consider that not so long ago there was arbitrary code execution discovered in... Adobe Reader.

Other reason is user mistakes. It is better to be warned before erasing the whole disk by one command.

Third reason is different shells. Root shell should be installed on / in case that rescue of system needed to be performed. Users' shells can be installed on /usr (for example user can use zsh).

Forth reason is that different programs don't work as root. They specifically know they are not supposed to, so you would need to patch system.

Fifth reason is that /root should not be on a separate partition while /home can (and should). Having /home separate helps for various reasons.

ALSO: WHY NOT USE AS NORMAL USER. You more often don't need to have root rights than do. It is a very little cost for security.

  • 3
    The fact that, as root, dd can do anything to any block device in the system, combined with the fact it's possible for root to do a lot of meddling, intentional and unintentional, with kernel and system stuff in /dev and /proc should be enough to convince anyone not to run as root unless needed.
    – LawrenceC
    Feb 27, 2011 at 21:46

You can also ride a motorcycle in the nude, and nothing may happen. But I bet you'd feel better if you had when you crash the bike...

  • 7
    perhaps, but think of the feeling you'd get the rest of the time !
    – Sirex
    Feb 24, 2012 at 7:55

Apart from the obvious point of security, it is clear you've never hosed your system by mistyping a command in the shell or a lapsus. If it happens, you'll understand why people freak out about it. And then you will cry in horror, and also realize that it was a highly educational experience, but you're not getting your system back anyway.

A thought: if you're being asked for the root password during normal use of your system (ie not installing packages or some other system administration task), you're doing it wrong.

  • +1 for reminding me of a few old experiences. Or should that be -1 for bringing them back up? Aug 24, 2010 at 21:27
  • 5
    I've never understood why people believe using sudo prevents mistyping commands. Last system i hosed a few years back was a sudo rm -rf /dir / job.
    – Sirex
    Feb 24, 2012 at 7:57

No, it's not overrated. In practice it's most under-appreciated. :-)

My small team at work, for example, is sharing an RHEL machine for development work: building stuff, testing etc. Everyone uses individual user accounts, but we also share the root password since people need this from time to time for quick sysadmin tasks. This also has resulted in us managing to hose the OS a few times in its short lifespan. Someone building a certain version of libc removed the system libc by a silly rm invocation. In another curious incident, the partition table was missing. (Ok, this had nothing to do with privileges.) Rest of the team is blocked until the breakage is fixed. One solution is to have someone volunteer to take up the sysadmin tasks. To this point we have not cared too much, except to allow people to learn their lessons: all of us need some teeth marks on our rear ends, and these are relatively inexpensive teeth marks.

The really curious might want to follow the principle of least privilege, and read Ken Thompson's paper, "Reflections On Trusting Trust." ("The moral is obvious. You can't trust code that you did not totally create yourself.")


Picking up on a comment of yours to another answer

but linux is about freedom, including freedom to destroy your own data, privacy and security

Even forcing people through sudo, Linux offers this freedom. The whole security argument that you want to shun is there to protect you from things are aren't you (read: malicious programs or programs controlled by malicious people).

Think of it as a seatbelt. Takes a second to use. Could save your life from other idiots out there (as well as yourself).

If you don't want to type your password all the time, sudoedit /etc/sudoers but if you keep running as root, one day you're probably going to run something that nukes your system and all your data.

If you're happy knowing that even something as crappy as Flash could reformat your computer, nobody here cares what you do. Run as root.

  • 2
    Not just malicious programms, buggy ones too (eg there was a bug in the kernel build system at one point that hosed your system if you did your kernel compiles as root)
    – Spudd86
    Aug 24, 2010 at 20:00

Why not run Damn Vulnerable Linux as your main system while you're at it. If you're going to ignore system security you might as well ignore all of it...

  • Technically computer with root as main user can be theoretically secured... Aug 23, 2010 at 15:04
  • 4
    @Maciej the only secure computer is unplugged, encased in concrete at the bottom of a lake. Aug 23, 2010 at 15:07
  • As Mitnick pointed out someone can get it outside the lake, break concrete and plug in (oh. he only said that someone can plug in unplugged computer using sociotechniques but the principle is the same). I tried to be careful to use 'technically' and 'theoretically' - also bad lock is better then no lock. For example I consider my current system enough secure despite lack of SELinux on it ;) Aug 23, 2010 at 15:25
  • @Marciej well security is all about cost/risk analysis. you never put more security around something than that something is worth. Aug 23, 2010 at 17:22
  • 1
    @Marciej and if it's worth nothing then there's no point in putting any security on it, at that point no vulnerability matters. Aug 23, 2010 at 17:24

You're talking about an OS that is the collaborative effort of countless people. If you run nothing but stable software you MAY be safe for a time.

As mentioned before, you would be surprised how small a thing can trash your entire HD. In my first year, I tried running in root alot because, well, back in the days of Fedora-core 3, there weren't as many fancy ways to admin your system from user.

At the time, I made a small xorg edit without backing up, because I didn't think it would hurt. Desktop gone. Then I tried to fix it manually, but couldn't figure out what I'd done, exactly. Later, I thought that maybe I could reinstall my drivers and desktop, but inadvertedly disconnected my ethernet, since it was also nvidia.

While running Arch for the first time, I ignored warnings to create a user and ran as admin for a while. I installed a package from AUR that I needed and after I rebooted, my entire install was busted.

Since I was in root, fixing these problems became a lot worse than they needed to be.

You might conclude I was just incompetent. But as others mentioned... typing "sudo" is a small price to pay for some peace of mind.

EDIT: Oh... and certain programs, like WINE, are expressly not supposed to run in a root environment. http://wiki.winehq.org/FAQ#head-96bebfa287b4288974de0df23351f278b0d41014


Safety reasons - a daemon or script vulnerability targeting Linux would have the Sysadmin power over your system.

Running as a simple user AND using sudo is a lot different in term of security. My Firefox is running as my user, so any Firefox vulnerability will only hit my account. Nothing else.


I agree with Maciej for the concern over security & having control over certain powers. Also, as you are the owner of your system you can disable this functionality if you want ;) it's your choice.

  • It's your choice, but once you're hacked, it's your responsibility to take the system down, or you are providing a hacker with a tool to get to other systems.
    – Kusalananda
    May 31, 2021 at 21:29

I can't see any great problem logging in as root for a normal session, as long as you don't do anything stupid.

I don't do it personally, because, occasionally I do something silly. I have never noticed that anything stupid I've done has been potentially a big problem, but I am not arrogant enough to think that I'd never do anything really stupid.

  • 8
    does using a web browser constitute as doing something stupid? Aug 24, 2010 at 19:54
  • 4
    @xenoterracide: It constitutes doing something stupid if you're logged in as root, I'd say. Aug 25, 2010 at 21:51
  • 2
    @David I know that ;) that's kinda the point Aug 25, 2010 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .