Why do I need root-privileges to update my package managers package list?


I always wondered why I need root-privileges to update my package managers package list?

I'm aware that the privileges are required to access the databases located in the designated directories.

But why can't I even check for updates with out root?

It doesn't affect other users. (I guess) To be aware of pending updates can be a security flaw, but the installed and the newest version can be detected easily on other ways.

What is the reason here?

This behavior is afaik quite common. Fedora, Ubuntu, Debian and Arch have this behavior, likely many other distros have it to.

  • Could you clarify what you mean by “check for updates”? apt update and co, or something else? – Stephen Kitt Jan 28 '18 at 12:38

If the package lists could be modified by normal users, it would be trivially easy to trick the package system into installing some other package instead if the superuser didn't update again before installing.

  • I don't want to alter the package list. I merely want to check for updates. No installing, no write access to the disk. – dudas Jan 28 '18 at 10:29
  • @dudas ok, so? Your question is asking why this is so and this is the reason. If you have a feature request, that should be filed as bug reports at the appropriate places. – muru Jan 28 '18 at 10:34
  • I just want to know if there is a reason for the fact that I need root privileges to do so. It's obvious that privileges are required to modify the package list. But for checking for updates I have no reason to modify the lists. – dudas Jan 28 '18 at 10:46
  • 1
    @dudas of course there is: simplicity of implementation! Why should the package management system, a highly sensitive component, have some sort of twisted in-memory package update checking mechanism, risking buffer overflows and OOM errors? – muru Jan 28 '18 at 10:48
  • Ok thats sounds like a good reason – dudas Jan 28 '18 at 10:52

A reason why the synchronization/update step is privileged is because the UID/GID of the process doing the update has to be able to make changes to the package directory tree. Yes, it could be done using a service or set[gu]id executable, but it's just as easy (and easier to manage) to restrict the function to people who are allowed to manage the system: other people shouldn't be messing with administrative tasks in the first place!

If you only want to see what packages would get upgraded, that's a separate question. Most distributions allow you to pretend/simulate an upgrade, which does not usually require any privileges. For Gentoo (what I happen to use), that would be emerge -up @world: check your distro's package manager for an equivalent option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.