2

What is the right way of installing programs that are not available in repositories: should my user own the binaries and keep them in ~/bin/, or should root own the binaries and keep them in, say, /opt/?

I'm talking about a desktop system, not a server, and normal programs that don't require any special privileges such as starting on boot etc. My concern is for safety. If the binary is owned by root, has mode 755, and it runs as my user, then a virus should not be able to overwrite the binary, as opposed to the case where my user would own the binary, right? I noticed that everything in /usr/bin/ is owned by root and has 755 permissions.

1 Answer 1

2

To be more specific there are two things to do here. You can "Run" a program or "Install" it.

Running

Running a program only requires that the executable file has the "execute" permission enabled. Programs run like this, from a normal User, have access to everything the User has read/write access to, which is usually directories like /home, /tmp, and /media/NAMEOFDRIVE.

So basically you can run self contained portable programs, scripts, and even build programs using make as long as they don't need to touch any directory owned by Root.

Installing

Installing a program involves copying it's core components to restricted parts of the OS in order to streamline it's execution and integrate it with other systems and programs. This requires Root permission because it involves writing to directories owned by Root. The reason Root exists is to prevent any rouge programs or scripts from doing critical damage to the OS without getting strict Permission from the User or Administrator.

Generally almost every directory in the "root"(/) of the filesystem is owned and writable only by Root. The exceptions are /home(where user profiles and data are stored), /tmp(where temporary files are written to in order to be deleted when no longer needed or upon reboot), and usually any folder under /media(but not itself) as this is where things like your USB drives and DVDs are mounted.

Summary

Basically, as long as a program or script has no need to write to a directory owned by Root then it shouldn't be run as Root. A Safety feature in Ubuntu(and Linux in General) is to always prompt the user when a program wants to access an area controlled by Root, which means everytime you run something like APT you will be prompted for your password. The only exceptions to this are programs designed to automatically start at boot, but these programs had to first get Root permission from the User before being able to set that up in the first place.

Also Ubuntu(and some other Distros) take things a step further with the use of the sudo and gksu tools. Instead of the original practice of giving a program Root access via su and that program then having free use of Root until closed, sudo and gksu only give Root access for a single command, further limiting the possibility of the User accidentally giving the wrong program free rein of Root.

3
  • So assuming that I have a binary from other source than the repositories. Should I save that binary to ~/bin, owned by my user, and just run it from there? Isn’t it safer to move it to /opt, chown it to root, chmod it to 755, and still run it as my user? For example, the Firefox binary, which is installed from the repositories, is owned by root, but it runs as my user. I think that would prevent a piece of malware that might come through Firefox to attach itself to the binary, because it is owned by root. Am I making sense?
    – George
    Apr 16, 2013 at 2:37
  • 2
    Moving a program to a directory outside your Home folder is only needed when that program has to be run by another user(or even Root). If a program only needs to be run by Yourself then you should just keep it in your Home folder. If it will need to be Run by Root or some other User at some point then you should move it to a directory like /opt or /usr/bin. Although, I recommend that you only put standalone programs/scripts in /usr/bin, if needed you can create a Symlink or Script in /usr/bin that links to the program that is sitting with it's needed files elsewhere.
    – japzone
    Apr 16, 2013 at 2:43
  • 2
    If you want to prevent anything from messing with a file then changing it's ownership to Root can be done easily. It doesn't even need to be in a Root owned folder to do this. If it's just a simple program or script that you want to easily run from Terminal, then just copy it to /usr/bin and then make it executable. That way it's easily accessible to all users but can't be modified without your permission.
    – japzone
    Apr 16, 2013 at 2:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .