I just heard that it isn't recommended to use sudo -i
on GUI programs - because it's less secure.
Is there any truth here - is there an advantage to this:
sudo -i gedit /random/file.name
over
pkexec gedit /random/file.name
I used to use gksudo, but that's been phased out, so now I use sudo -i
to prevent root owning files in my home area. But should I really be using pkexec
?
Here is a reason:
The environment that PROGRAM will run [in], will be set to a minimal known and safe environment in order to avoid injecting code through
LD_LIBRARY_PATH
or similar mechanisms. In addition thePKEXEC_UID
environment variable is set to the user id of the process invokingpkexec
.
root
user with UID 0sudo
can't do (it can reset environment variables, and see the variablesSUDO_USER
andSUDO_UID
).pkexec
is that another user can authorize for you, but I'm no security expert. By the way, we can still view the eOS.se beta, so you can link to the discussion directly.pkexec
needs to be configured to run graphical programs. Ubuntu, Debian and Arch Linux don't configure it for that by default. Does elementary OS? If not, asking users to usepkexec
is just a hassle. And where there's hassle, users will switch to easier commands.