Non root apt updates?

[xariv]

Problem: user needs to constantly (daily, or often enough) escalate privileges using sudo in order to keep an updated system.

Malware running can easily pick up root password.

Is something like the Tails trick of using a non-root user to perform a procedure that was defined for root rights possible in this case?

Simple clearnet connection proof of concept for Tails

Tails is using sudo/root to setup the chroot and uses sudo -u clearnet to start the browser. So while the browser runs indeed as non-root, the procedure requires root rights. This is possible through the /etc/sudoers.d/zzz unsafe-browser exception. This however doesn’t grant a path to executing arbitrary code/programs as user root or user clearnet. If you find a way to do that, I guess Tails might consider this a security buy.

[Patrick]

Really easy, just needs a sudo configuration snippet in /etc/sudoers.d configuration drop-in folder.

PackageKit likely is also capable of doing this but that would be a kinda heavyweight solution for this and might introduce its own issues.

Implemented in Whonix 15 source code just now.

implement upgrade-nonroot

upgrade-nonroot

This is something that security maximalists would want to remove (user shouldn’t have capability to upgrade; extra code).

But for hardening / lockdown purposes it might be better to remove group sudo from user user which then would also deactivate this feature.