[SOLVED] How to safely run GUI applications with root privileges?

860lacov · 2020-10-01 07:23:04

Some time ago I wanted to run mousepad as root. It wasn't work because of error (maybe not error but information):

Mousepad is not designed to run as root - you will need to find alernatives

I started to search for alternatives and on other forum (for Arch based distro) someone told me that it can be unsafe to run GUI applications as root and that I could use micro (terminal based editor with mouse support)
or XED and then use: (it's only example)

xed admin:/etc/fstab

That's ok for me in terms of editing simple files. I'm trying to switch from nano to vim so this problem will be obsolate soon.

I wanted to know what could go wrong with elevated privileges and I've found information that there could be a problem with $HOME for example.

SO is there a safe way to run any application as root? I don't need it for every application but recently I installed zenmap.
It has link to run as root but it's not working. Nothing happened when I tried to launch it.
Currently I'm learning how to use nmap but zenmap has some nice examples for commands and output is much cleaner than one from nmap.

I know that It will work with sudo but I want to avoid any potential problems in the future.

One soludion/advice was to use sudo -i but I'm nos sure if it's a proper way to solve this "problem".

I've found also a wiki article
https://wiki.archlinux.org/index.php/Ru … ns_as_root
There is an advice about GVFS so maby thats the way to achieve what I want?

Last edited by 860lacov (2020-10-03 21:41:45)

Wild Penguin · 2020-10-01 07:59:36

Well... there is no "one answer fits all" -answer to your question. It is a whole different subject/matter how pedantic you are going to be with security, say, in a personal toy which does not (hopefully) contain anything important to you, or a mission-critical server running in, say, some industrial plant. Sometimes you may want to trade convenience for security, or sometimes you might trade security for convenience.

I think the question should be approached with these kind of statements (or sub-questions):

Do you know what the root account is and can do?
Do you know the code of the application (and the related stack) you are running contains? Do you trust the writer of the code? (G)UI? What about user errors (misclicks, mistyped keyboard shorcuts)? Intentional exploits in the code? Unintentional bugs in the code? Consider all of these questions in the context of the point 1.
What do you actually need to do as root?

(some of these are ... kind of rhetorical, but still valid IMHO)

Now, I gather you know the answer to point 1. I just put it here since the 2. point does not make much sense without it. I can not answer to the 2. point, and I think no-one can.

As for 3. point - well, for example, in the context of editing configuration files, you actually only need to write them, not run the whole editor as root. There are two sensible approaches: 1) use a simple(r) text editor, which is well tested (in terms of code! i.e. no GUI) which does not contain known exploits / bugs or 2) only escalate to write permissions when writing the file! In simpler and general terms: only escalate to root privileges when absolutely needed (I think some GUIs already do this: they only ask for root privileges when clicking "apply" etc.). For recurring tasks, use specific sudoers file configurations or specific user accounts (or both). However... YMMV (consider the trading part in the beginning)!

Last edited by Wild Penguin (2020-10-01 08:10:55)

Mr.Elendig · 2020-10-01 08:00:17

you can use sudoedit instead of running the editor as root, and you can set up cap instead of running zenmap as root for most use cases.

860lacov · 2020-10-01 09:21:15

Thank you for answers.

It was pretty clear that there is no simple answer.

As I mentioned. I can use nano (vim actually too) to edit fstab for example.

Main reason for asking this question was proboem with zenmap shortcut in whisker menu in xfce
As I said. There is a shortcut/ link to run it as root but it doesn't work for me.

I checked it and it refers to sh script in /usr/share/zenmap...
I read it but I know almost nothing about scripting so I wasn't able to figure out what to do next.

seth · 2020-10-01 10:41:01

Simply avoid it at all costs. There's no (good) reason to run GUI clients as root and *always* a better solution.
For zenmap, that's certainly nmap, but if you insist on the GUI frontend, you can lever nmaps capabilities as Mr.Elendig pointed out, see eg. https://wiki.archlinux.org/index.php/Capabilities & https://secwiki.org/w/Running_nmap_as_a … leged_user
This also allows you to run nmap as regular user and still have features that normally require root permissions (along the security concerns described in the latter link)

sudoedit allows you to edit files in your preferred GUI editor, eg. try

EDITOR=mousepad sudoedit /etc/fstab

860lacov · 2020-10-01 11:48:02

Thank you once more.

I think that I'll go with nmap --privileged
But...
I already did sudo nmap ...
Is there a way to check if any damage is done? It's private network and I'm not concern about my laptop being exposed but I don't know if any crucial system settings has been changed.

And one more thing to clarification.
I checked sudo --help
There are options in my intrest.
-i, -s and -H
(I know that I can do sudo su too)

To do updates and software installation I always do sudo pacman ...
And I believe that is ok because Arch wiki says so.

But when should I use one of parameters above (i, s, H)
I'm after man sudo lecture but I'm not entirely sure if I get it.

seth · 2020-10-01 12:07:58

Running nmap as sudo is little a risk, the problem is that nmap can run random scripts and this way be used as a lever, but just "sudo nmap 192.168.0.1" does nothing bad.
(The same risk remains w/ the extended caps, they only allow you to run random nmap commands as regular user, which is actually more of a risk than running it sudo - excelt the latter doesn't work w/ zenmap)

"sudo -s" gets you a root shell (like "sudo su" but not stupid), "sudo -i" a root login shell and -H should™ be the default behavior anyway ("sudo env | grep HOME" should be "HOME=/root")

There's nothing fundamentally wrong w/ running stuff as root (eg. pacman), but because of the inherent risks it's a good idea to limit this as much as possible and the big fat cumbersome crufty GUI toolkits are not exactly good with "limits"…

860lacov · 2020-10-01 12:29:21

seth wrote:

Running nmap as sudo is little a risk, the problem is that nmap can run random scripts and this way be used as a lever, but just "sudo nmap 192.168.0.1" does nothing bad.

With sudo I did -sS, -sT, -A, -sV and --script=vulners.nse
In mixed configurations.

I thought that scripts delivered by nmap itself should be safe.

seth · 2020-10-01 13:07:47

Yes, again: "random scripts", ie. such provided by a malicious actor.

Sorry if you got the impression to have compromised your system by some controlled sudo invocations.
The real issue is that the approach to "in doubt let me sudo this" provides a broad attack vector - and especially w/ GUI processes.

860lacov · 2020-10-01 20:00:11

seth wrote:

Yes, again: "random scripts", ie. such provided by a malicious actor.

So scripts delivered with nmap and vulscan (official Arch repos) shoukd be safe to use with elevsted privileges ?

seth · 2020-10-01 20:41:20

Do you consider either to be a "malicious actor"?

Arch Linux

#1 2020-10-01 07:23:04

[SOLVED] How to safely run GUI applications with root privileges?

#2 2020-10-01 07:59:36

Re: [SOLVED] How to safely run GUI applications with root privileges?

#3 2020-10-01 08:00:17

Re: [SOLVED] How to safely run GUI applications with root privileges?

#4 2020-10-01 09:21:15

Re: [SOLVED] How to safely run GUI applications with root privileges?

#5 2020-10-01 10:41:01

Re: [SOLVED] How to safely run GUI applications with root privileges?

#6 2020-10-01 11:48:02

Re: [SOLVED] How to safely run GUI applications with root privileges?

#7 2020-10-01 12:07:58

Re: [SOLVED] How to safely run GUI applications with root privileges?

#8 2020-10-01 12:29:21

Re: [SOLVED] How to safely run GUI applications with root privileges?

#9 2020-10-01 13:07:47

Re: [SOLVED] How to safely run GUI applications with root privileges?

#10 2020-10-01 20:00:11

Re: [SOLVED] How to safely run GUI applications with root privileges?

#11 2020-10-01 20:41:20

Re: [SOLVED] How to safely run GUI applications with root privileges?

Board footer