Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.
Sign up to join this community
How does Firefox update itself without asking for root/sudo password?
It's installed in /usr, where regular users don't have write permissions, and neither /usr/bin/firefox, nor any files in /usr/lib/firefox are setuid.
There must be some kind of daemon that runs with root permissions, ready to update Firefox, when asked?
The reason you do not need to enter sudo passwords for upgrades in modern systems is because these processes currently are managed through Polkit (formerly called PolicyKit). This is a mechanism that checks if a request, i.e. for updating, is authorized or not. That is defined through polkit rules.
Firefox is by default installed through the APT package management system. In Ubuntu 21.10, Firefox is installed as a Snap package. For most of the updates, the policy is configured such that these can be checked for and carried out while a user with root access is logged in, without an extra need to provide the sudo password. For kernel updates, the policy is set up to still require specifically entering the sudo password.
