Some thoughts about anti-virus software for Linux

[Brian McKee]

On Thu, Jan 22, 2009 at 12:16 PM, Mario Vukelic
<mario.vukelic at dantian.org> wrote:
> On Thu, 2009-01-22 at 09:37 -0500, Brian McKee wrote:
>> If you install software from the repositories, you used root
>> privileges to do so.  Therefore, the program you installed now can run
>> as root whenever it wants to.
>
> This is not true. Usually the program will run with the privileges of
> the user that starts it. The programs that run with root privileges are
> very rare, despite all packages being installed by APT (in a standard
> Ubuntu system).

You're right, and I didn't express myself well at all.

What I was trying to say is software installed from the repositories
COULD do many malicious things to your system, without you authorizing
it to do that, other than the inital authorization to install it.
Perhaps a better example would be a script that is installed in the
system crontab.  That would run as equivalent to root without user
intervention.

Brian