84 votes
Accepted

Can I create a *super* super-user so that I can actually have a user that can deny permission to root?

The "user" you want is called LSM: Linux security module. The most well known are SELinux and AppArmor. By this you can prevent certain binaries (and their child processes) from doing certain stuff (...
Hauke Laging's user avatar
  • 90.4k
69 votes
Accepted

Difference between sudo user and root user

Executive summary: "root" is the actual name of the administrator account. "sudo" is a command which allows ordinary users to perform administrative tasks. "Sudo" is not ...
Edward Falk's user avatar
  • 1,963
56 votes
Accepted

How to stop a script from running if it's not root (and echo "Not running as root! Exiting...")

#!/bin/sh if [ "$(id -u)" -ne 0 ]; then echo 'This script must be run by root' >&2 exit 1 fi cat <<HEADER Host: $(hostname) Time at start: $(date) Running ...
Kusalananda's user avatar
  • 335k
52 votes
Accepted

root cannot write to file that is owned by regular user

This is a new behavior available on Linux kernels since version 4.19 to prevent attacks using /tmp/ tricks. The default value of the option might have been enabled later or be different depending on ...
A.B's user avatar
  • 36.7k
50 votes
Accepted

Why are executables in e.g. /usr/sbin writable by root?

It doesn't really matter if the files in /bin (or any other standard directory where executables are kept) are writable by root or not. On a Linux server I'm using, they are writable by root, but on ...
Kusalananda's user avatar
  • 335k
50 votes

Can I create a *super* super-user so that I can actually have a user that can deny permission to root?

You're misunderstanding the concept of the root user. In plain English, root is at the "top of the tree". What if you decide one day to have a "super super user", and then next month, a "super ...
Andy's user avatar
  • 591
50 votes
Accepted

How do file permissions work for the "root" user?

Privileged access to files and directories is actually determined by capabilities, not just by being root or not. In practice, root usually has all possible capabilities, but there are situations ...
ilkkachu's user avatar
  • 139k
45 votes
Accepted

'sudo' is not installed, I can't install it, and it asks if I am root

If you do not have sudo installed, you will need to actually become root. Use su - and provide the root user's password (not your password) when asked. Once you have become root, you can then apt-...
DopeGhoti's user avatar
  • 76.2k
45 votes

Given that root has all privileges, why is root ALL=(ALL) ALL in /etc/sudoers?

That entry ensures that root can run sudo. If you comment it out, sudo ls run as root will fail. It’s a convenience: it means users can run sudo commands without thinking about things too much, i.e....
Stephen Kitt's user avatar
41 votes
Accepted

/etc/shadow permissions security best practice (000 vs. 600 vs. 640)

The idea behind setting /etc/shadow permissions to 000 is to protect that file from being accessed by daemons, even when running as root, by ensuring that access is controlled by the DAC_OVERRIDE ...
Stephen Kitt's user avatar
36 votes
Accepted

Accidentally renamed tar.gz file to a non tar.gz file, will my file be messed up

Your file will be fine. Renaming a file will not alter the file's contents in any way whatsoever. In fact, you would still be able to successfully extract the contents of your compressed tar archive ...
Kusalananda's user avatar
  • 335k
34 votes

How do I check if I have root access?

Yes. If you are able to use sudo to run any command (for example passwd to change the root password), you definitely have root access. If you, for example, run sudo -s and it gives you a shell, you ...
Kusalananda's user avatar
  • 335k
34 votes

What determines which Linux commands require root access?

It's mainly a matter of what the tool or program does. Keeping in mind that a non-superuser can only touch files that it owns or has access to, any tool that needs to be able to get its fingers into ...
DopeGhoti's user avatar
  • 76.2k
34 votes
Accepted

Is having root password for sudo considered a best practice or the opposite?

Some would consider this a security risk because it undermines two of the main purposes of using sudo rather than su, which are: sudo makes it easy to allow users to run some, but not all, commands ...
cas's user avatar
  • 78.7k
32 votes
Accepted

How is allowing login for a sudo group member safer than allowing root login?

sudo improves safety/security by providing accountability, and privilege separation. Imagine a system that has more than one person performing administrative tasks. If a root login account is enabled, ...
Seamus's user avatar
  • 2,959
30 votes
Accepted

"PermitRootLogin no" in sshd config doesn't prevent `su -`

PermitRootLogin only configures whether root can login directly via ssh (e.g. ssh [email protected]). When you login using a different user account, whatever you do in your shell is not influenced by ...
n.st's user avatar
  • 8,138
29 votes
Accepted

How to copy a directory which root can't access to a directory that only root can access?

You can use tar as a buffer process cd .rubies tar cf - ruby-2.1.3 | ( cd /opt && sudo tar xvfp - ) The first tar runs as you and so can read your home directory; the second tar runs under ...
Stephen Harris's user avatar
27 votes

How do I drop root privileges in shell scripts?

Covering only runit and sudo misses a lot. There is actually a whole family of toolsets like runit, and a wide choice of tools for doing exactly this, the very task that they were designed for: ...
JdeBP's user avatar
  • 68.8k
27 votes
Accepted

Two root accounts, what to do?

Processes and files are actually owned by user ID numbers, not user names. rootk and root have the same UID, so everything owned by one is also owned by the other. Based on your description, it sounds ...
Rahul's user avatar
  • 13.6k
26 votes

Can I create a *super* super-user so that I can actually have a user that can deny permission to root?

If you just want to prevent files or directories from being changed/deleted then just set the immutable flag on them. chattr +i <file> Not even root will be able to do anything to them unless ...
CR.'s user avatar
  • 1,219
25 votes
Accepted

How can I protect my user passwords and passphrase from root

You can't. The root user has full access to the machine. This includes the possibility of running keyloggers, reading any file, causing the programs you run to do things without showing them in the ...
dr_'s user avatar
  • 29.7k
25 votes

Is having root password for sudo considered a best practice or the opposite?

Consider a hypothetical (but very plausible) scenario: a user who has the root password mistakenly changes the password for root, and does not record it. You now have a situation where no one has the ...
bxm's user avatar
  • 4,855
24 votes

How to change permissions from root user to all users?

Just type: chmod -R 777 directory/ and it will be available to all.
Gani Rakhmatov's user avatar
24 votes
Accepted

Allow bash script to be run as root, but not sudo

The only way I could think of is to check one of the SUDO_* environment variables set by sudo: #!/usr/bin/env sh if [ "$(id -u)" -eq 0 ] then if [ -n "$SUDO_USER" ] then ...
Arkadiusz Drabczyk's user avatar
23 votes

Two root accounts, what to do?

That indeed looks like a backdoor. I'd consider the system compromised and nuke it from orbit, even if it is possible to remove the user you have no idea what interesting surprises were left on the ...
Simon Richter's user avatar
22 votes

How to stop a script from running if it's not root (and echo "Not running as root! Exiting...")

I think what you want is rather to check that you have super-user privileges, that is, that your effective user id is 0. zsh and bash make that available in the $EUID variable, so you can do: if ((...
Stéphane Chazelas's user avatar
21 votes

QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root' when running sudo commands

The XDG_RUNTIME_DIR is one of the standard directories, defined by the XDG Base Directory Specification (freedesktop.org) $XDG_RUNTIME_DIR defines the base directory relative to which user-...
zeppelin's user avatar
  • 3,822
21 votes
Accepted

debian su - and su $PATH differences?

Very recently (with version 2.32-0.2 of util-linux from 27 Jul 2018) Debian switched to a different su implementation, see bug 833256. The "new" su is from util-linux while the "old" one was contained ...
scai's user avatar
  • 10.8k
20 votes

Unable to delete file, even when running as root

I had a similar problem but had tried both permissions and chattr previously to no avail. Root in Terminal. CD to Directory. However what worked for me was to check permissions of directory where ...
Keith Mann's user avatar
20 votes
Accepted

Where do /root/.bashrc and /root/.profile come from on a Debian system?

root's files are copied from base-files: if they're missing, its postinst copies /usr/share/base-files/dot.bashrc to /root/.bashrc and /usr/share/base-files/dot.profile to /root/.profile. Additionally,...
Stephen Kitt's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible