Restrict root access

[Patrick]

@madaidan

Because that will run all commands in that shell as root and commands that don’t need root will likely be run as well. Using sudo for individual commands make it less likely you’ll run random commands as root.

Valid point. There might be a solution for that.

What about adding a new user admin?

Long term version:

• user user not being member of group sudo / su etc.
• Users are advised to login as user admin and then use sudo.

At first, this could be a documentation-only thing for advanced users. (This could be implemented very soon.)

Not sure the cumbersomeness usability wise would allow this to ever become a default configuration.

---

Very long term version:

• wayland will sort the need to login using a virtual console.

@madaidan

Yes. Anything in a virtual console can’t be sniffed via xinput as that requires Xorg.

So until we have a solution for that (realistically only wayland in many years most likely), I think we should go for virtual console login. At least as security advice for advanced users.