Hot answers tagged

83

The "user" you want is called LSM: Linux security module. The most well known are SELinux and AppArmor. By this you can prevent certain binaries (and their child processes) from doing certain stuff (even if their UID is root). But you may allow these operations to getty and its child processes so that you can do it manually.


80

If you take a look at the executable sudo: $ which sudo /usr/bin/sudo $ ls -la /usr/bin/sudo ---s--x--x 2 root root 208808 Jun 3 2011 /usr/bin/sudo You'll notice that it carries the permission bits ---s--x--x. These can be broken down as follows: -|--s|--x|--x - - first dash denotes if a directory or a file ("d" = dir, "-" = file) --s - only ...


77

Any user, including root, can forward their local email by putting the forwarding address in a file called ~/.forward. You can have multiple addresses there, all on one line and separated by comma. If you want both local delivery and forwarding, put root@localhost as one of the addresses. The system administrator can define email aliases in the file /etc/...


65

Why root over SSH is bad There are a lot of bots out there which try to log in to your computer over SSH. These bots work the following way. They execute something like ssh root@$IP and then they try standard passwords like "root" or "password123". They do this as long as they can, until they find the right password. On a world wide accessible server you ...


62

Yes, root can: $ echo Hello you\! > file $ chmod 600 file $ ls -l file -rw------- 1 terdon terdon 11 Feb 27 02:14 file $ sudo -i # cat file Hello you! In any case, even if root couldn't read your files as root, they can always log in as you without a password: $ whoami terdon $ sudo -i [sudo] password for terdon: # whoami root # su - terdon $ whoami ...


62

Warning: by the end of this answer you'll probably know more about linux than you wanted to Why reboot and poweroff require root privileges GNU/Linux operating systems are multi-user, as were its UNIX predecessors. The system is a shared resource, and multiple users can use it simultaneously. In the past this usually happened on computer terminals ...


55

Check the permissions of the directory. To delete a file inside it, it should be writable by you chmod ugo+w . and not immutable or append-only: chattr -i -a . Check with ls -la and lsattr -a.


51

You're misunderstanding the concept of the root user. In plain English, root is at the "top of the tree". What if you decide one day to have a "super super user", and then next month, a "super super super user"(!). How far "up" the tree would you want to go? How would you shuffle all the permissions and hierarchy to make that work? Who is always at the ...


50

It doesn't really matter if the files in /bin (or any other standard directory where executables are kept) are writable by root or not. On a Linux server I'm using, they are writable by root, but on my OpenBSD machine, they're not. As long as they are not writable by the group or by "other"! There is no security issue having, e.g. -rwxr-xr-x 1 root root ...


49

The commands in a script execute one by one, independently. The Script itself as the parent of all commands in the script, is another independent process and the su command does not and can not change it to root: the su command creates a new process with root privileges. After that su command completes, the parent process, still running as the same user, ...


48

In the page Top Ten One-Liners from CommandLineFu Explained is suggested this trick (the #3): :w !sudo tee % this write the current buffer to the stdin of the command after the !. The % symbol is substituted with the current filename.


46

#!/bin/sh if [ "$(id -u)" -ne 0 ]; then echo 'This script must be run by root' >&2 exit 1 fi cat <<HEADER Host: $(hostname) Time at start: $(date) Running cache maintenance... HEADER swapoff -a && swapon -a echo 1 >/proc/sys/vm/drop_caches cat <<FOOTER Cache maintenance done. Time at end: $(date) ...


45

Linux has its origins in Unix and Unix was initially developed as a multi-user operating system. You could have one user disrupt other users by wanting to reboot the system. Only the administrator with root privileges could do that.


45

That entry ensures that root can run sudo. If you comment it out, sudo ls run as root will fail. It’s a convenience: it means users can run sudo commands without thinking about things too much, i.e. they’ll work the same way whether they’re running as a sudo-enabled user or root (whether that’s a good idea is another question). It also means that scripts ...


40

To know whether a particular user is having sudo access or not, we can use -l and -U options together. For example, If the user has sudo access, it will print the level of sudo access for that particular user. $ sudo -l -U pradeep User pradeep may run the following commands on this host: (ALL : ALL) ALL If the user don't have sudo access, ...


40

If you do not have sudo installed, you will need to actually become root. Use su - and provide the root user's password (not your password) when asked. Once you have become root, you can then apt-get install sudo, log out of the root shell, and actually use sudo as you are trying to, now that it will have been installed.


38

When executing shell scripts that have the setuid bit (e.g., perms of rwsr-xr-x), the scripts run as the user that executes them, not as the user that owns them. This is contrary to how setuid is handled for binaries (e.g., /usr/bin/passwd), which run as the user that owns them, regardless of which user executes them. Check this page: https://access.redhat....


38

Privileged access to files and directories is actually determined by capabilities, not just by being root or not. In practice, root usually has all possible capabilities, but there are situations where all/many of them could be dropped, or some given to other users (their processes). In brief, you already described how the access control checks work for a ...


36

Your file will be fine. Renaming a file will not alter the file's contents in any way whatsoever. In fact, you would still be able to successfully extract the contents of your compressed tar archive using tar -xvz -f opt where opt is the name you accidentally gave the file. Renaming it to its original name would obviously be of help to you for knowing ...


35

Here are the answers: root has always full access to files and directories. The owner of the file usually has them too, but this is not always true. For example: -r-xr----- 1 user1 users 199 Oct 14 18:42 otherfile.bin user1 is the owner; however they can only read and execute, but root still has full access (rwx) to the file. RUID is the Real User ID ...


35

Its quite natural and a policy matter and convenience, it had been allowed from GUI because you are physically logged in to the machine. ( Some Linux distributions will still ask you for password if the GUI is not running as root , I am using Centos 6 and there is even no GUI shutdown/reboot option for my user , there is only log out and lock option) From a ...


35

The idea behind setting /etc/shadow permissions to 000 is to protect that file from being accessed by daemons, even when running as root, by ensuring that access is controlled by the DAC_OVERRIDE capability. Since Fedora 12 and RHEL 6, Fedora-based systems run daemons without DAC_OVERRIDE, but grant DAC_OVERRIDE to administrator login sessions (so that the ...


34

sudo cannot be considered universal: Red Hat Enterprise Linux: sudo is installed by default on Red Hat Enterprise Linux and its derivatives,1 but it only installs ready-to-use in RHEL 7 and newer. Red Hat Enterprise Linux 7 added a new option to the installation screen where you create the first non-root user, a checkbox labeled "Make this user ...


33

You aren't doing anything wrong, and there's nothing to fix. /run/user/$uid/gvfs or ~$user/.gvfs is the mount point for the FUSE interface to GVFS. GVFS is a virtual filesystem implementation for Gnome, which allows Gnome applications to access resources such as FTP or Samba servers or the content of zip files like local directories. FUSE is a way to ...


32

It's mainly a matter of what the tool or program does. Keeping in mind that a non-superuser can only touch files that it owns or has access to, any tool that needs to be able to get its fingers into everything will require superuser access in order to do the thing which it does. A quick sample of Things that might require superuser access include, but are ...


31

You're changing root's password. sudo wants your user's password. To change it, try plain passwd, without arguments or running it through sudo. Alternately, you can issue: $ sudo passwd <your username>


31

If I understand you correctly, fire up a terminal, navigate to one level above that directory, change to root and issue the command: chown -R user:group directory/ This changes the ownership of directory/ (and everything else within it) to the user user and the group group. Many systems add a group named after each user automatically, so you may want: ...


31

To empty a file as root, you can also use the truncate command: $ sudo truncate -s0 file.txt The -s0 sets the file's size to 0, effectively emptying it.


29

When you run sudo vim you start vim as root. That means that it is the viminfo file in /root that is the problem. You should do rm /root/.viminf*. To make sure of this, run sudo vim and execute this command: :!echo $HOME. This will show you that your home directory is /root. I would recommend that you do not run vim as root, but rather use sudoedit. This ...


29

root is the superuser account on the system — it (basically) has all privileges. Many systems are configured so that you can use the sudo command in front of another command to run that command "as root" — that is, as if you are the root user, with the same privileges. It is usually the case that you need root privileges to install system packages, which is ...


Only top voted, non community-wiki answers of a minimum length are eligible