3

I just wanted to confirm my understanding of a couple of things related to root privileges. Is it correct that:

  • The user name "administrator" is not a reserved name with implied privileges, it is just a user name and I can use it without inadvertently defeating inherent security?
  • The effects of using the SU command in the terminal are limited to activity within that terminal session. For example, becoming root in that terminal session would not bypass the request for a password in a concurrent application launched from, say, the applications menu, or give me root privileges if I concurrently open another terminal session.

Also, what command would tell me whether I currently have root privileges?

  • whoami will let you know the current user and lets you know whether you are normal user or root user. – Ramesh Sep 27 '14 at 15:35
  • Thanks. I tried that and all I saw was my user name. What indicates whether I am a normal user or root user? – fixer1234 Sep 27 '14 at 15:41
  • @fixer1234: You'd see root if you were the root user. – chrk Sep 27 '14 at 15:44
  • Am I just "one user" at a time? I don't inherit root privileges to my username (appear as username and root), I stop being username and become root (only root appears)? – fixer1234 Sep 27 '14 at 15:59
  • Just answered my own comment by experimenting, which also confirmed the second bullet. – fixer1234 Sep 27 '14 at 16:08
1

The user name "administrator" is not a reserved name with implied privileges, it is just a user name and I can use it without inadvertently defeating inherent security?

You get root privileges by having a user ID number of 0. If the user "administrator" has a different ID number, it will just be a regular user

The effects of using the SU command in the terminal are limited to activity within that terminal session.

The effects are for the shell spawned by su (or any command run with the -c option). And any processes which are descendants of that shell/command will keep those privileges (unless they explicitly drop them).

Also, what command would tell me whether I currently have root privileges?

id will tell you which user/group you're running as, plus the user/group ID numbers. If the ID number for the user is 0, you have root privileges.

3

The name “administrator” comes from the Windows world. In the Unix world, “system administrator” is a job description, but “administrator” doesn't mean anything special with respect to accounts.

Unlike Windows, Unix accounts do not intrinsically have a notion of privilege. The privileges in an account are conferred by the files that they can access, by the setuid commands they can run, by the sudo rules they are allowed to use, by the applicable SELinux policies, etc. These can be conferred directly to a user, or to a group that the user belongs to.

There is one exception: the account whose user ID is 0 gets a lot of extra permissions (basically, the permission to do just about everything). This account is conventionally called root (it would be possible to use another name, as far as the kernel is concerned, since the kernel doesn't know about user names, but that would break a lot of administration-related software).

The root account is not meant for users to log into in normal operation. It's a system account. The administrator only runs commands as root to perform system configuration tasks, not to do other work. The administrator may log in as root sometimes to perform system installations or repairs, but wouldn't use the root account for non-system-related tasks like web browsing and email, they'd use their personal account for that.

Informally speaking, an administrator account is the account of a user who is able to run commands as root. Often this is done through sudo, a program which allows users to run commands as other users (including root) if they are authorized to do so by the sudo configuration.

Privileges are associated with a process and inherited by their child processes. When you run a process with elevated privileges (e.g. through su or sudo), only that process and the processes that it starts have elevated privileges. The rest of the session is not affected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.