Why does Google Chrome not run as root user by default in Kali Linux? Is it a security issue?

  • 8
    Quick question for you - do you think it should run as root? What implications would that have? – Rory Alsop Sep 15 '18 at 18:34
  • @RoryAlsop I do not see how this answered their question. Given they are a new user, they may also be new to the dangers of root. Particularly running graphical applications as root, and the dangers of privilege escalation. – safesploit Sep 15 '18 at 21:02
  • 2
    Safesploit - what do you mean? I certainly didn't try to answer the question. I commented, specifically asking them to consider something. – Rory Alsop Sep 15 '18 at 21:08
  • @RoryAlsop I just feel the number of downvotes towards this question to be unreasonable, as it asks a valid question. Which despite research looking for a duplicate question, the general theme I came across doing this was 'don't run web browsers as root' without giving clear reasons. I am curious myself to why the developers put these safeguards in place, to begin with, while others have not. Particularly when I found quite simple bypasses. – safesploit Sep 15 '18 at 21:44
  • 2
    @reed No. The problem is that Kali is not designed to be secure, and so runs everything as root by default whenever it can. People who use Kali in this way are just asking to get pwnt. – forest Sep 16 '18 at 0:36

It's basically because of the principle of least privilege (see for example: https://en.wikipedia.org/wiki/Principle_of_least_privilege). There is no reason to give Chrome all the power and capabilities that root has. More privileges mean more trouble in case something goes wrong.

As a side note I have to say though, that I am skeptical about the advantages of low privileges in the specific case a typical Linux desktop gets compromised, because the typical desktop user regularly uses sudo to basically get all the privileges. The user just trusts sudo, but sudo is just meant to be used for convenience, not for real security, because it doesn't provide enough separation of privileges. But this is a side note, regarding a specific issue. In general the principle of least privilege always applies.

  • Even with bad use of sudo, low privileges can still be beneficial. For example, imagine a malicious process is executed while the user is doing something sensitive (transferring all their Bitcoins or whatever), and only later do they use sudo in a way that lets the process get root. By the time it gets root, it may be too late. – forest Sep 17 '18 at 3:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.