11

This is probably something I don't understand since I am used to Windows and am only starting out with Ubuntu. I know that software in linux comes in packages what I don't understand is why can't non-admin users install software.

I mean, every application is run by a specific user, and that user will only be able to run that applciation with his privilages, so if he has no admin privileges, the application also won't be able to access unauthorized directories etc.

I want most of the time to work on my PC with a non-admin user since it seems more safe to me, most of the time I have no need for admin privileges. and even though I know viruses in linux are uncommon I still think the best practice is to work on the computer in a state that you yourself can't make any changes to important files, that way viruses also can't harm any important files, but I need to install software for programming and web-design etc. and first of all I don't want to switch users all the time. But also it sounds safer to me that everything being done on the PC will be done through the non-admin user.

I'll be glad to know what misunderstanding I have here, cause something here doesn't sound right.

0

6 Answers 6

16

Why you're asked for a password

Most software is designed to touch sensitive files, i.e. sensitive to the security of your private data or the systems integrity. This is why software installation is a potential risk and should be validated by a user who knows what he is doing. Even for open source Software you can not be sure that no bad code bits arrive with your percious new audio player until someone checked. And even then something could have been overlooked or packages could be manipulated on the way. Who knows what's hidden in the depth of the program? One user should.

Ubuntu provides a comfortable way of installing software. Software developers can rely on that comfort and make the assumption that synaptic/software center/apt enables them to access these sensitive files. Canonical checks the software repository for bugs and malicious code. But the ultimate responsibility is yours.

If the software in question does not need access to sensitive files, it can (in principle) be installed in the home folder though not in the Ubuntu way. You will for instance have to compile the source code yourself or run a custom install script. Beside the greater efforts of that it has the disadvantage of not allowing other users access to your just installed program (as they have no right to access your home-folder). They will need to installed it a second time. So this way of installation makes no sense in a large scale and in a small scale it's usually easier to type a password than to install software manually.

So that's why Synaptic aaks for a password and why it's good that it does.


Sudoers

If you are really in dire need of having other users install software without password, you can add them to the sudoers list. This however will result in a great security risk. If that doesn't concern you, consider that there a bot networks out there with great resources to break into your computer via Internet. They do this just to add your computer to the net and use it's connection and computing power without your knowledge to do all sorts of illegal stuff. They are not even after your personal data your you for that matter. They just want to hijack your PC. Still not concerned? Really? Then look at the following answer which is a small how-to on the workings of sudoers list:

How to make Ubuntu remember forever the password after the first time

Read that carefully. You could lock yourself out of the system.

The scare is over

So now you have the scare behind you are and taking the matter seriously, I can tell you it's really not that bad. If you trust the people working on your computer, and you don't have programs installed that allow remote access to your system (e.g. an ssh- or ftp-server), then it's really not that dangerous to disable the password stuff. Just don't do it without considering the worst case and think of your private data.


Overlook on the proceedings (don't do this lightly - see text and link above):

# in shell type these commands
sudo su       # in case you do something stupid, you'll have a root shell open
select-editor # (optional) will allow you to select text editor
visudo        # secure way to open sudoers list

An editor will open ADD a line like this:

confus confusion=(root) NOPASSWD:/usr/sbin/synaptic,/usr/bin/software-center

Syntax explanation: username machine=(usernameToRunCommandAs) command1,command2,.... So the above line allows confus to run synaptic and softwarecenter as root without password query. You will still need to start it with sudo synaptic or gksudo synaptic or put an alias `alias synaptic='sudo synaptic' in your shell profile.

2
  • thanx confuse, you really made me understand. nice to see such a nice community for linux :)
    – fiftyeight
    Jun 12, 2011 at 20:03
  • 2
    You're welcome. Since linux as an open source project relies on people putting their work into it without compensation, you will find many helpful people in the communitiy.
    – con-f-use
    Jun 12, 2011 at 20:44
4

They can not. Here is the deal.

  1. The 1st user created in Ubuntu is considered a special user: this is a user with administration permissions. This means when ever this user wants to do admin tasks he will be prompted for his admin password. Those tasks are issued by putting sudo in front of a command.

  2. All other users (unless you change it yourself) are normal users and can not install sofware system wide unless the admin (1st user) lets them do so. Normal user can only put things in their own home and if they want to they can mess up their home directory.

This way 1 person is responsible for the system.

You could make more than 1 user an admin (so able to install software) by adding those users to the sudoers file.

Besides that they can install software in their home but this does depend on the software: sometimes the installer wants to add it to the system and that is not allowed. These installs tend to be from source so it is not the easiest method ;)

2

In Ubuntu, the administrator has root privileges (often referred as just "root", as in "you need to be root").

Access to files can be split in three types:

  • read (numeric value 4)
  • write (numeric value 2)
  • execute (numeric value 1)

These attributes can be set on every file or directory. Furthermore, these restrictions can be set on:

  • the owner of the file
  • the group of the file (users can be a member of this group)
  • all other users which are not the owner nor in the group

These principles forms the basics of Linux file permissions. In windows, everything can be executed. Give it an .cmd or .exe extension for example. In Ubuntu, you need to add the execute bit explicitly, otherwise a permission error will be raised.

When an user executes a program, the program accesses files as that user and these file permissions kicks in. By default, locations where programs are installed are privileged, only the owner can write. This owner is root. All other users can only read and execute the program, not write to it. That's why you need root privileges to install programs.

Ubuntu has a special program called sudo (SuperUser DO ...) to run programs with root privileges. This can be used for installing software. When run, the sudo program asks you for your user password. Note that only members of the admin group can run programs as root using sudo.

In Windows, you would go to a website and download an installer. Ubuntu works with a software repository in which you can search for programs and install those. These programs are reviewed before added to the official repositories, so you can be sure that no harmful intentions exist in the programs.

3
  • ok I understand, so can't users install software into their home directory somehow and that way it doesn't touch sensitive areas? I mean, if they really want they can probably download the files necessary for the program and put the in their home directory anyway, can't them?
    – fiftyeight
    Jun 11, 2011 at 17:07
  • They can install software in there home directory. They just need to compile it themselves and put the binaries there. Of course the software installed in such a fashion will not be able to access protected files elsewhere. Though most software is build in a way, that it needs to access such files.
    – con-f-use
    Jun 11, 2011 at 17:15
  • I've updated the answer with the "Ubuntu way" for installing software. It is possible to install software in your home directory, but that really depends on what you've downloaded. SOmetimes, it's an archive with the extension .tar.gz or .tar.bz2. These can often be extracted in the home directory directly, but sometimes you need to compile the program before use. If the file has a .bin or .sh extension, it's often an executable installer which vary in their usage. Remember that Ubuntu does not use file extensions to determine the type, it uses the contents of it.
    – Lekensteyn
    Jun 11, 2011 at 17:16
2

Non-admin users cannot install software because the packages run as root when they're installing as they install to privileged parts of the system, run maintainer scripts, etc.

There is currently no way to tell the system "Install firefox from this .deb but in a user's home directory so that it's isolated from the rest of the system"; which is why currently it's mostly an all or nothing affair. (This is also why running third party .debs is bad, the package and it's included scripts have root access to your system)

1

You touched upon a BIG difference between windows and ubuntu. In Windows when you are logged in as an admin programms will be installed without asking for a password. This enables also malware to run their programs. In Ubuntu (Linux) even being logged in as an admin the system will always ask for your password when you change the system. Therefore, malware cant intrude your system easily. To sum up run Ubuntu as an admin. If you open another user account for your kids than give them only normal user rights so they cant screw up the system.

4
  • With "admin", do you mean a user with sudo-rights? The real admin would be root.
    – user13032
    Jun 11, 2011 at 22:57
  • Windows software doesn't ask for a password not because you're necessarily loged in as the Admin. but because Windows simply doesn't work that way, thus if You were to download a deb file that unknowingly contains a dangerous script and you put your pass to install the file it can damage the system just as Windows malware. Jun 12, 2011 at 22:22
  • And even the "Admin" Windows account isn't really the system file's owner it is SYSTEM, which in This case would be like this, the "Admin" which is the account you made upon installation, and ROOT which is the system file's true owner Jun 12, 2011 at 22:26
  • Newer versions of Windows feature User Account Control (UAC) which prompts during privilege escalation by default but features configurable thresholds for prompting. UAC is present starting in Windows Vista (2007)
    – nijave
    Dec 18, 2023 at 13:17
1

You can install software as a regular, non-admin, user. Software installed by a regular user will be "owned" by that user, which means that, in effect, it is an extension of the user -- it has no more permissions than the owning user does, though it may have fewer permissions, at the user's option.

A common practice is for a user to create a 'bin' directory within their home directory. If /home/[user]/bin exists, it is added to the beginning of that user's path. You can place executable files in /home/[user]/bin, or in any other folder to which you have write and execute access, and execute the program from there.

What a regular user can't do is install a package system-wide. A regular user can't put executable files in /usr/bin, for instance, nor grant them permissions that exceed the user's own permissions. This is, obviously, for basic security reasons -- you need admin permissions to reformat a hard drive, for instance, and you don't want someone unauthorized doing that.

As far as I know, you cannot use package management software to install a software package unless you have admin permissions, as package management is done system-wide.

However, without admin permissions, you can create shell scripts, write and compile source code, download and compile "tarballs", which are packages of source code for complex applications, or download executable files, so long as these can be used with only the permissions of a regular user. Some indie games, such as World of Goo or X-Plane 9, can be installed and used in this way.

3
  • On rereading the question, I don't think my answer is directly relevant. A more relevant answer would be that, assuming the user's regular account has admin privileges, he should be prompted for the password before doing anything that requires superuser permissions, and that should be safe enough, but he could just create a second user account that does not have admin permissions if he prefers.
    – bgvaughan
    Jun 12, 2011 at 23:30
  • Your question was helpful actually, thank you :)
    – fiftyeight
    Jun 17, 2011 at 17:10
  • Some Windows installers automatically install software into the user's "home" (profile) directory if the installer is ran without admin permissions. Or put a different way, Windows software installations aren't standardized (outside Windows App Store, in newer versions) the same way Ubuntu packages are.
    – nijave
    Dec 18, 2023 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .