[Discuss] sudo

[bctill]

On 2023-04-02 19:03, Jeremy Van Veelen wrote:
> Hi Bernie,
> 
> You can limit sudo to particular commands, as well sudo can be
> configure to require a password with every use (or even after x
> minutes).  However if an account simply has all the privileges you
> require you may simply
> 
> sudo su - {account}
> 
> Does that help?
> 
> Jeremy
> 
> On Sun, Apr 2, 2023 at 7:00 PM bctill <bctill at ece.uvic.ca> wrote:
> 
>> Hi all --
>> 
>> It seems to me that the security and permissions model of Linux is
>> based
>> on the false premise that each system has multiple users.  The
>> opposite
>> is far more often true: each user has multiple systems, and this has
>> 
>> been the case for decades.  Even in an enterprise environment, it's
>> the
>> network that has multiple users, not any one machine.
>> 
>> In consequence of this anachronism, almost every command I type
>> starts
>> with sudo.  Not only is this excruciatingly cumbersome, but it
>> seriously
>> undermines the vaunted safety benefits.
>> 
>> The reality is that I want almost every process I create to execute
>> with
>> all my acces rights, and I am perfectly capapable of applying
>> suitable
>> access restrictions in the relatively rare cases when I execute a
>> process that warrants them.
>> 
>> Is there a way to set up Linux to reflect this reality?
>> 
>> One thing I do like, by the way, is that I don't have to log in
>> every
>> time I turn my machine on because Linux can power down without
>> logging
>> me out.
>> 
>> Or is it just Ubuntu that works this way?
>> 
>> Regards,
>> -- Bernie.
>> 
>> _______________________________________________
>> Discuss mailing list
>> Discuss at vlug.org
>> http://vlug.org/mailman/listinfo/discuss_vlug.org
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://vlug.org/mailman/listinfo/discuss_vlug.org

Hi Jeremy --

I guess my question is can I do the opposite of what you suggest?  Can I 
set up the system so I am automatically the superuser unless I 
explicitly downgrade privileges for the process(es) created by executing 
a particular command?

And if I can do that, how do I prevent my web browser, for example, from 
automatically inheriting all those superuser access rights?

Regards,
-- Bernie.