sudo apt-get-update-plus security issue ?

[glass]

On both my Gateway and Workstation VM’s when I run:

sudo apt-get-update-plus dist-upgrade

it doesn’t ask for my password. It literally starts checking the various repositories and then informing me of what needs updated. Then if I press enter, it downloads and installs the files. This has been happening for a while. The first time that I used the command in the VM’s it did ask for my password. Even after shutting down the VM’s and KVM and restarting it all, it still does not ask for my password.

sudo everything else asks for my password.

[sheep]

Whonix 15? I believe there was a change to not require password when updating. Reason: malware running in the workstation can pick up the password using a keylogger and escalate privileges. Updating is an ongoing and standard operation done by all users.

[Patrick]

Non root apt updates?

Problem: user needs to constantly (daily, or often enough) escalate privileges using sudo in order to keep an updated system. Malware running can easily pick up root password. Is something like the Tails trick of using a non-root user to perform a procedure that was defined for root rights possible in this case?