Eleven programs that run as root
On a minimal Debian install, eleven programs carry the setuid bit, which means they run as the file's owner rather than the user who started them - and that owner is root. It is not a misconfiguration; changing your own password or mounting a filesystem needs privilege a normal user does not have. The value of the list is that it is short and stable. An entry you do not recognise on a machine you did not change is worth more attention than most alerts.
On a clean install, eleven programs run as root no matter who starts them.
A normal user cannot edit the password file or mount a disk. Yet the commands that do those things run without asking anything.
Search the filesystem for the bit that makes this happen. Eleven files.
Look at what they are. Changing your password. Changing your login shell. Mounting and unmounting. Switching user. A helper for the message bus, and one for SSH host keys.
None of that is a mistake. Each needs privilege the person running it does not have, and the bit hands it over for the length of that program.
The point is not that eleven is dangerous. It is that eleven is small, and it barely changes.
Which makes an extra one loud. On a machine you did not modify, an unfamiliar entry here beats most alerts you will get.
Save the list now. Compare it when something feels wrong.
#linux#security#selfhosted#infosec#sysadmin
❯ Save the list now. Compare it when something feels wrong.