[arm-allstar] General Observation

[David Lang]

On Wed, 17 May 2017, "Nathaniel Biser via arm-allstar" wrote:

> The one consistency that I have read and heard about Linux is that you
> shouldn't run as root on a regular basis.  The specific reasons escape me
> at the moment but I'm gonna go out on the limb and hypothesize that it's
> because if your system was compromised, and you are running as root, it
> would be much more detrimental then if you were running as a user.

my day job is security (banking and such)

The "don't run as root" dates back to the days of Unix machines running multiple 
users, and since root can do anything, if a process running as root has a flaw, 
the attacker then has full control over the machine.

When a machine is only running for one purpose (in this case the allstar 
software), and the machine doesn't have any special permissions on your network, 
it really doesn't matter much if an attacker ends up as root on the machine, or 
as the user that runs everything that matters on the machine

https://xkcd.com/1200/

> I am curious as to why is the Allstar software page defaults to running as
> root upon installation.  Like I said, I am only a student in all of this
> but I would like to hear the pros and cons of doing so.

running as root is much simpler to setup, and even if it was running as the user 
'allstar' with permissions added for anything it needs to do, the damage that 
someone could do on the pi once they get in is virtually identical, so it's 
arguably not worth the effort to set it up to run as a different user.

Davdi Lang