I have these credentials that I am using for logging in with my Linux distribution (Ubuntu 13.04) when starting the computer:


I type the password on the login screen and I am in the desktop.

Then also when I am installing something from ubuntu center I need to type this password (or when performing something using sudo etc.

My question is:

Am I giving the program and installation root access by providing my password associated with my account?

I mean if I should set some root name and password to protect my Linux from malware etc.


When you type your password to install a program, your password is read by sudo under the hood. Sudo is a privileged program that runs other programs as root, but it only accepts to do so when called by users who have been authorized to do this. Such users are commonly known as “sudoers”. The Ubuntu installation program creates a first user account and makes it a sudoer. You can configure other accounts to be sudoers by granting them administrator privileges in the user administration GUI.

Sudo asks for your password to confirm that it's you at the keyboard. This has two benefits: someone walking by while your back is turned won't be able to perform administration tasks, and you get some user interface feedback that you're about to change your system configuration.

Sudo runs the installer program as root. This does not mean that the program will run as root. All normal program installation is performed by root, because only root can write to the system directories and modify the database of installed packages. With very few exceptions (setuid or setgid programs), when you run the program, it runs with exactly the same privileges you already have — because “your privileges” actually means “the privileges of the processes that are running in your session”.

By default, Ubuntu does not set a password for the root account. This is more a matter of usability than security. The main benefit of not having a separate password is that users don't have to remember multiple passwords.

Setting a password for the root account does not have any benefit to protect against malware. If you have malware on your machine, it can snoop on everything you do, including typing your password. It can even spoof a password prompt. It doesn't matter whether you end up typing your account's password or the root password: once malware is running on your machine, you've lost: it isn't your machine anymore but the attacker's.

Fortunately, under Linux, it is fairly easy to remain free from malware. Stick to programs that are provided by your distribution. Ubuntu has an extensive collection, so there aren't many tasks that require getting software from other sources. These programs get scrutiny from a lot of people, and if one is ever discovered to contain malware or to have a security vulnerability, this will be promptly fixed in a security update.


Am I giving the program and installation root access by providing my password associated with my account?

Short answer: yes.

Long answer: You cannot ("legally") change the user of a running process from the outside. Two things can happen:

  1. A user level program calls a program (like sudo) which has superuser rights (by configuration) no matter who runs it. This SUID program allow the caller to execute more or less everything with superuser privilege but it is usually configured to ask either the calling user's or the target user's password before it does so. That's why the calling process needs the password.
  2. A daemon which is already running (at higher privilege) may do certain actions on behalf of the calling process but demands the (super)user password in order to do so. No big difference.

How secure your system is (against either malware or humans) depends more on the quality of your password than on using the same or different passwords. If you are afraid that your user password is likely to be seen by others because you enter it often then preventing your user from sudo access and use root with a different password may be advantageous.

  • thanks, so basically if I install something via apt-get and the user put some malicious feature e.g. keylogger or some backdoor in this app he can get info from my computer or my actions. Am I correct? Could he e.g. scan the drive and delete/download some of my files in my Ubuntu computer with this installed script or change my password or other nasty stuff? – Derfder Jun 4 '13 at 19:34
  • If you install malicious software with superuser rights (without precautions) then you lose. You may prevent the installer from executing scripts which come with the package and shall be executed on installation, you can check for files being installed SUID root (and erase the SUID bit) and you may run software which needs superuser rights with some kernel level limitations: SELinux, Apparmor, lxc. The basic rule is: don't install software you don't (or should not...) trust. Run untrusted software in a VM. – Hauke Laging Jun 4 '13 at 19:43
  • Is VirtualBox secure for that or could some malware attack my linux via VirtualBox too? – Derfder Jun 4 '13 at 20:07
  • @Derfder I don't know the exploit history of VirtualBox but I would consider that quite safe. – Hauke Laging Jun 4 '13 at 20:09

You basically have two accounts. You are normally logged in with a regular user account and when you need to have root access then you re-login as root and provide root's password to do this. The root password should be different from the regular user's password. By default, on some distros such as Ubuntu, the root account is disabled. To elevate your permissions on these systems you use a command called sudo so that you can run some/all commands using root's privileges.

For example to login as root:

$ sudo su -

To run a command as root:

$ sudo apt-get install gimp

The 1st example will set user (su) to root (assuming you have permissions to do so). After running this command you'll be left at root's prompt.

The 2nd command will run the Debian/Ubuntu installer program and install a program called gimp as root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.