7

I just heard that it isn't recommended to use sudo -i on GUI programs - because it's less secure.

Is there any truth here - is there an advantage to this:

sudo -i pantheon-files /location

over

pkexec pantheon-files /location

I used to use gksudo, but that's been phased out, so now I use sudo -i to prevent root owning files in my home area. But should I really be using pkexec?

This is apparently the reason:

The environment that PROGRAM will run [in], will be set to a minimal known and safe environment in order to avoid injecting code through LD_LIBRARY_PATH or similar mechanisms. In addition the PKEXEC_UID environment variable is set to the user id of the process invoking pkexec.

What does the above mean (in English), and is there any truth that sudo -i is more likely than pkexec to damage my system?

10

The commands (pkexec and sudo -i) in and of themselves aren't necessarily harmful. However they do different things in terms of granting permissions to apps.

The sudo ("substitute user do") command allows you to run a process as another user, typically the root user. That is, by default it runs the process as a user with unlimited power.

When you use pkexec, you're using PolicyKit. PolickyKit is the part of the system that keeps track of the types of privileges that certain users and programs should have. It depends on certain policy files being defined that describe these privileges. A policy for Ubuntu Software Center, for example, would grant permission to use apt, but it wouldn't necessarily grant permission to change network settings. This kind of control is what the documentation you referenced means by "minimal known and safe environment". The intention is that PolicyKit does not grant more permissions than are necessary.

Why does this matter to you and is it really less safe to run with sudo?

This depends on both the policy written and the app itself. For an app like Files, running with elevated permissions can be pretty dangerous in any case. But imagine that Files had permission to do things you would never want it to do, like create or delete user accounts. Since Files can have 3rd party plugins, imagine that a malicious third party plugin exists that runs in the background and tries to delete accounts. If you've installed software from a PPA or from a downloaded deb, you could already be infected with this type of malware. With a strong PolicyKit policy, Files would never be able to take this action, rendering the malware ineffective. But with sudo, it would have full permissions to make this malicious change.

But what if the policy isn't strong?

It's true that a policy can be written to essentially do the same thing as sudo. However, policies are managed as part of the system's security updates. So running an app with pkexec can actually get more secure over time with updates as stronger system policies are written. Using sudo will always grant full permissions.

| improve this answer | |
  • Okay, that makes sense, but it is such an edge case - if someone happens to install a malicious plugin and then happens to run it as root, and then there is no bug in the policy kit file... So is it really less safe to run with sudo? - yes but the chances are so so slim I can't really see this as a valid concern to have tbh... – user3 Jul 13 '15 at 22:00
  • 5
    @Tim not really that far fetched tbh. Do you have an PPAs installed? Are you certain an app you installed from there isn't carrying hidden malware? You can't really know. Every time you use sudo, you are also potentially granting those permissions to malware. Is it possible to never get vaccines and also never get sick? Sure. But why? Why do the dangerous thing when you can do the safe thing instead? – Daniel Foré Jul 13 '15 at 22:03
  • Well for 1. when the safe thing doesn't work - e.g. the example at the comment thread 2. the safe thing doesn't remember your password for 15 minutes and 3. not all GUI programs work with the safe method e.g. gedit, scratch-text-editor and 4. it doesn't accept arguments as in the bug report. I'd be fine with it if it had the same functionality as sudo (especially the 15 minute thing) but right now it doesn't. And 5. the chances are so low of the "you could already be infected with this malware" that the slight risk outweighs the bad ui of slightly safer. – user3 Jul 13 '15 at 22:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy