As far as I know malware is very uncommon in Linux systems, because majority of important commands require root access. So my question is, can malware just wait until I enter sudo mode (for example by doing sudo apt-get update) and then execute malicious commands in that timeframe while sudo mode is active, without user's knowledge?

  • 1
    Once malware is running on your computer, it's no longer your computer, it's the attacker's computer. (Exception: if the attacker is stupid, an antivirus might be able to remove the malware. But you can't rely on the attacker being stupid. Antivirus software only keeps stupid attackers out, which makes it pretty much useless.) Aug 6, 2014 at 23:10
  • So define 'running' on my computer. Let's say I accidentally download malware, but it cannot do anything because it does not have root access, is it right? That's the main reason why linux systems are mostly absent of malware as far as I understand. Aug 7, 2014 at 15:40
  • 1
    If you download malware and don't execute it, there's no problem. If you execute malware on your account, then obviously it can do everything you can do: log everything you type, use all the network access that you have, etc. Root access isn't that useful for most malware; mainly, root access allows malware to hide its track a lot better. Aug 8, 2014 at 8:50

2 Answers 2



If your user account is compromised (as in someone/something else can run arbitrary commands in your name), then they can for instance modify your ~/.bashrc and add something like:

alias sudo='sudo sh -c '\''install-my-backdoor; exec "$@"'\'' sh'

so that when you run sudo apt-get update, it actually runs sudo sh -c 'install-my-backdoor; exec "$@"' sh apt-get update, that is run install-my-backdoor as root and then apt-get update.

They can also monitor what you type and get your password (which is even worse).

  • Well I am not talking about compromised user account, just if attacker/malware can run root commands while user is in sudo more. But thanks for this info. Aug 6, 2014 at 20:49
  • 1
    @user1880405, if the attacker can run arbitrary commands as you, then they can get superuser privilege the next time you run sudo (or if you've run sudo recently from any terminal that is still active, they can run sudo again without needing your password) Aug 6, 2014 at 20:54
  • Makes sense, but then I wonder is it easy for an attacker to run commands as me? Aug 7, 2014 at 15:43
  • @user1880405, generally not, they need to exploit bugs, misconfiguration, or your trust for that. But your question as worded, suggests that you had already executed the malware code. Aug 7, 2014 at 16:03
  • But then again even if I executed it without sudo, it most likely won't do much harm? But like you said, I guess there are many factors to consider. Aug 7, 2014 at 16:17

No. Sudo is not a mode of the computer. Sudo executes the specified command with root privilege. Malware can only get in if you use sudo to execute the malware or if the apt-get executable has been compromised. Of course apt-get is protected and requires root privilege to modify.

Notice that if you bring up two terminals and enter sudo su to operate in the shell as root, commands entered in the other window do not have privilege.

  • 5
    Nonsense. If the user account is infected by malware, that malware can piggyback on a sudo call so that what sudo is instructed to execute is not what the user instructed. The malware can also log the credentials passed to sudo so that afterwards it can call sudo surreptitiously — not that it would need to, since having had root access once is enough to plant malware running as root. @user1880405 Aug 6, 2014 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .