-2

I know that some system tasks are permitted only to privileged users/processes, but still a super user (usually the root in Unix/Linux) or administrator can present so much problems in regards to security and is most often tried to be exploited. You all know why.

I am interested not only (but mostly) in Unix/Linux general answers. What could be the rationale behind it?

  • Do you mean why does su still exist today, now that sudo is so widespread? Or are you asking why the root user exists? Please edit your question and clarify. – terdon Mar 25 '16 at 14:57
  • @terdon I edited it. I wanted to now more about the design reason behind the super user, root (PID = 0). Not the specific commands that call for it. – user8 Mar 25 '16 at 18:43
  • 2
    In that case, your question makes no sense. How else would administrative tasks be accomplished? Obviously, allowing any user to do the things that only root can do is a security nightmare. – terdon Mar 25 '16 at 18:53
  • 2
    What did you see exactly? Other variants of what? I think there is a valid question in here somewhere but I'm afraid you're just not expressing it in an understandable way. What would the alternative be? Rebooting into single user mode whenever you need to install new software? – terdon Mar 25 '16 at 19:04
  • 1
    A counter-question for you: Given the potential dangers of electrocution, why is it still possible to strip the insulation from the wires used behind an electrical outlet? – Wildcard Mar 25 '16 at 19:43
3

If you wouldn't have a superuser, you would need to be able to execute all tasks, that now require privilege elevation, as a normal user.

That would make it even more dangerous to leave your desk unattended, because anyone who gets at your keyboard before the screensaver locks the sytem will be able to e.g. add a new user account, format the disk etc.

Removing the superuser would not remove the attack target for exploits, it would just create an easier one.

5

The existence of a superuser, in one form or another, is logically necessary. There has to be some credential that allows configuring credentials. That's root.

Root doesn't have to be a user account. It could be a capability, for example. Unix historically went for a simple design and used a single concept to implement both accounts and capabilities: users. Each person who uses the system gets a user account, and system services are also assigned a user account. The system service that, among other things, has control over user credentials (/etc/passwd, and other functionality that plays the same role on modern systems), can indirectly obtain any capability. Under the Unix design, root can also directly obtain any capability (e.g. by running su, or the underlying system call), but even if it was not so, it's difficult to prevent the credentials manager from assigning themselves any credentials¹.

Modern systems have evolved to a more fine-grained security model. For example, Unix early on added a notion of groups to allow users to share files, but groups can only be managed by root. Most modern Unix systems have access control lists that allows users to share files without root's intervention. More and more Linux system use security mechanisms such as SELinux that limit what even root can do.

But more complex security models are a double-edged sword. More fine-grained permissions allow for greater control, and they allow more security policies to be implemented in a simple way (for example ACL for access rather than indirect access through setuid programs). But more complex security policies are harder to review (there's so much more to review, in a more complex language), and the code to implement those policies is more complex hence has more risk of being buggy.

¹ This can be prevented by dual control or by cryptographic means, but that limits functionality (if there's no way to run arbitrary code with ultimate privileges) and availability (if the system is locked down too much, this increases the risk of getting locked out).

3

Because you should be free to do what you want with your system, I suppose the creators thought so.

Security and exploits are not a problem as long as you act responsibly, you can do a lot of damage as a normal user too. I don't see a reason to restrict users.

2

In what is mostly single user Linux systems, su is usually used for becoming root, but it has a lot of other features in a multiuser environment.

If I'm with someone else and I need to temporarily switch from their account to mine without starting a new shell, I can use su to become me, run the commands I want, then exit out. I need my login credentials in order to do this. Remember, this goes back to the time when you were at a 300bps terminal and getting to another terminal might be in another room.

As root, you can su to anyone else without knowing their password. This is good for tracking down issues with a user's account.

sudo has mostly supplanted what su does and does it in a much better way since you can specify what user and what commands can be run. As an admin, having su still has its place though.

0

The su command is there because that means you can log into root without logging out of your account. The root account itself is for system administration and for controlling user accounts and performing tasks like mounting file systems. You can disable or remove the su command:

# rm -f /bin/su    #deletes 'su' command

and you could also give no sudo-access which means only root can do system administration.

# deluser user sudo    #user being the account to be removed from group sudo
  • There still isn't a reason to remove the su command because it is almost just the same as logging in as root. – Scripty Coder Mar 25 '16 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.