Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What special "wrong thing" can root do? There might os level files that only root can edit or delete. I don't care about those. I can reinstall the os anytime if I should ever mess it up. All the value is in my data.


  >>There might os level files that only root can edit or delete
Nailed it.

  >>I can reinstall the os anytime if I should ever mess it up
Not everyone has the luxury or time to do this. Why break it in the first place?

  >>All the value is in my data.
? Cool story.


For most people, accidentally destroying various system files and "only" having to reinstall the OS would be considered a serious inconvenience.

If you want an example of something that could cause lasting damage, it's probably pretty easy to put your Apple product into a non-booting state by fiddling with NVRAM or PRAM settings as root. I'm not familiar with them off the top of my head, though.


With the advent of EFI booting, you can brick basically any motherboard by wiping it's EFI partitions.


One example relating to OS X is that malware running as root can defeat anti-keylogger protections such as this: https://developer.apple.com/library/content/technotes/tn2150...

If you were running your web browser as root, and a malicious website used a vulnerability to drop some malware on your system, then it would have complete power to do what it liked without needing to escalate privilege using another vulnerability.


Worse than destruction is undetected malicious modification. Say you decompress a specially crafted archieve which overwrites certain parts of the system enabling a backdoor. As a common user this would be blocked, but as root you'd probably not notice the malicious sideeffect.


When you're doing maintenance on a production environment which is serving hundreds or thousands of customers, in many cases you can't just "reinstall the OS anytime". Sure, ideally your environment is set up with redundancy and you fail over nicely, but still...


To be fair, if you are serving hundreds or thousands of customers, I hope you have some form of redundancy.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: