4 ms·
While users might be able to authenticate as root, the accounts dont run as root. zs-macbook-pro:~ Zach$ touch foo.bar zs-macbook-pro:~ Zach$ ls -la foo.ba
by Zev 18y ago
While users might be able to authenticate as root, the accounts dont run as root.
zs-macbook-pro:~ Zach$ touch foo.bar
zs-macbook-pro:~ Zach$ ls -la foo.bar
-rw-r--r-- 1 Zee staff 0 Jul 20 18:32 foo.bar
vs
zs-macbook-pro:~ Zach$ sudo touch bar.foo
# normally it asks for password here. I used sudo earlier to rm -rf
# something in /usr/local so it didn't ask this time.>
zs-macbook-pro:~ Zach$ ls -la bar.foo
-rw-r--r-- 1 root staff 0 Jul 20 18:36 bar.foo
- tptacek 18y agoNo, they're just in ALL=(ALL) sudoers. You're right; it's not NOPASSWD by default. Until very recently, that was trivially evadable with InputManagers. Not that it matters. I don't want to perpetuate the myth that root really helps you against malware. If you can bind a socket, you can propagate. If you can read a file I own, you can get my bank account and mail. Game over. It is just very hard to secure a desktop OS against its own users.