Why is it not recommended to permanently use the root account for all tasks?

Question

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422

But I still fail to understand the reasoning behind this advice, as long as we are talking about a single user home PC (for a multi-user system the advice seems obvious to me: a maliocious or compromised user must not be allowed to adversely affect other users)

As far as I'm aware the advice against running root all the time falls in two categories:\

1. Security: If I get compromised the attacker will do less damage if they're not able to gain root privileges

Will they? Even without root they can: Encrypt my data and demanding ransom; connect my computer to a botnet and mount a ddos attack against a legitimate site; connect my computer to a botnet and use it to ditribute illegal materials, prompting Men in Black to knock my doors; unless im mistaken, set up a keylogger; steal my browser profile and gain access to my email account I'm logged to at the moment.

Might I ask in what ways can they screw me up that actually requires them to gain root?

Because it seems it pretty much does not matter if I'm root or not...

Obligatory xkcd: https://xkcd.com/1200/

2. Accidental mistakes such as issuing rm -rf against a system critical directory

Once again: Without root I may not be able to accidentally remove or corrupt /etc or /bin or /usr, but I'm still able to accidentally remove or corrupt my data in /home. The latter is arguably worse than the former: the former can be fixed by OS reinstallation, but the latter requires me to have recent backups, or else I cannot recover.

So, with root or without root, I still have to pay utmost care when I issue dangerous commands such as rm.

In light of the above, may I ask why is it recommended to not use root for everyday use?

Answer 1

You can consider this recommendation as a road sign that warns you about icy road. It does not prohibit you from driving fast. It just warns you that many people who drove fast had accidents. If you are a world champion in ice racing, may be you will just smile and drive further with the same speed. But for the most people following recommendation and reducing speed on an icy road will prevent them from accidents.

The same is about using root all the time.

You and some other people can be absolutely fine using root account all the time many years. But the most users are not as perfect as you are. Here are just a few examples why other people (not you) do mistakes:

• ... they are not fully focused on what are they doing, they are listening to music, talking to others, and submitting some commands in the shell
• ... they do typos and, for instance, pick up a wrong command from the history and hit Enter immediately, before they understood that it was not the command they wanted
• ... they are tired, but want to complete some task, work one or two hours more, and cannot precisely control every single command they issue
• ... their mental capacity is limited, they cannot take into account every single important factor that can affect particular command
• ... their knowledge is not complete, their assumption about how particular command works is not quite correct

In such cases issuing a potentially dangerous command without having root privileges may prevent from a lot of troubles.

You are right, even without being root one can make huge problems. But if one uses root account all the time, for the most users it leads to much more problems.

Answer 2

Because of this thing called the principles of least privileges. This says that someone or something should only have access to only the privileges needed to carry out their functions and no more. Following the good logic of ITSec, if someone or something can do their functions without needing to be granted certain privilege(s) then why does that person need to have them in the first place?

---

Most of the day to day task done by a user on a normal single user system can be done without logging in as root. So why should you use it unless you really need to? We learn an important lesson of only using what is necessary.

---

What can happen if I do?

One reason is that if you are logged in as root, the software you run will also be running as root. This means if you get compromised by malware on the root account, it also has full access as well. This makes it easy for it to access other parts of the system and do more than if it was using a limited account, such as allowing it to hide itself more effectively by modifying the system to lie to you. Check out rootkits. These take advantage of having root access to hide themselves and other malware. And yes a rootkit doesn't necessarily give you root access.

Answer 3

As far as I'm aware the advice against running root all the time falls in two categories:\

1. Security: If I get compromised the attacker will do less damage if they're not able to gain root privileges

Will they? Even without root they can: Encrypt my data and demanding ransom;

Yes, your data, but not everyone's data. You mention this is a single-user machine, but if your user is separate from "root" then there still are multiple users. Similarly, they don't get access to other paths outside of your home.

2. Accidental mistakes such as issuing rm -rf against a system critical directory

Once again: Without root I may not be able to accidentally remove or corrupt /etc or /bin or /usr, but I'm still able to accidentally remove or corrupt my data in /home. The latter is arguably worse than the former

No, the latter is inarguably better than the former. In the latter case you can only destroy your stuff. In the former case you can destroy your stuff plus everything else. Therefore it is clearly better to not run as root because you can clearly destroy less stuff (your stuff only versus your stuff plus everything else).

So, with root or without root, I still have to pay utmost care when I issue dangerous commands such as rm.

Yes, you still have to be careful regardless--but just because you have to be careful in both instances does not mean that both instances are the same. For example, I have to be careful when I handle eggs and I have to be careful when I handle plutonium. This does not mean that eggs are the same thing as plutonium.