Unrestricted Admin Mode
Donate
user-sysmaint-split boot menu entryIn Kicksecure, admin access is restricted by default for greater security. However, unrestricted admin mode can be configured. Read more about unrestricted admin mode and how to configure Kicksecure to suit your needs.
Overview[edit]
Unrestricted admin mode is, in some regards, the opposite of user-sysmaint-split. In unrestricted admin mode, standard methods to perform tasks that require administrative rights, such as sudo and pkexec, are available for the Kicksecure default limited account user.
Most other operating systems do not include user-sysmaint-split by default, so they do not refer to this as "unrestricted admin mode". In such systems, unrestricted admin mode is implied. However, Kicksecure provides the flexibility to switch between user-sysmaint-split and unrestricted admin mode based on your needs.
Starting from Kicksecure version TODO Xfce and above, Kicksecure includes user-sysmaint-split by default.
Uninstalling user-sysmaint-split and Enabling Unrestricted Admin Mode[edit]
As the new default for Kicksecure is user-sysmaint-split, unrestricted admin mode must be specifically enabled. This section documents how to disable user-sysmaint-split and switch to unrestricted admin mode, where the account user can use sudo.
Optional. Discouraged.
Warnings:
- Reverting to unrestricted admin mode increases the risk of privilege escalation attacks and may weaken system security.
- It is discouraged to use
aptfor this purpose to avoid meta package removal issues. (Problems that can occur when important packages are removed together. For elaboration, see Debian Packages.) Instead, it is recommended to proceed as per the instructions below.
Platform specific. Select your platform.
Kicksecure
Select a method.
If the user-sysmaint-split package is installed by default, the easiest way to remove it is by using the REMOVE sysmaint-user-split | enable unrestricted admin mode boot option on the GRUB screen.
1. Reboot the machine.
2. Select REMOVE sysmaint-user-split | enable unrestricted admin mode from the list of boot options.
Figure: remove user-sysmaint-split boot menu entry
3. Authenticate as necessary to log in as the sysmaint account. You may have to provide a disk encryption passphrase and/or the user password for the sysmaint account, if either or both passwords are set.
4. Type the word yes into the dialog box confirming that you really do want to uninstall user-sysmaint-split.
5. Click "OK". A terminal window will appear, showing the logs generated while uninstalling user-sysmaint-split.
6. When the text Command exited. You may close this window safely appears, close the terminal window. The system will automatically reboot.
7. Done.
The process of removing user-sysmaint-split is now complete.
using dummy-dependency
Alternatively, you can use dummy-dependency to remove the user-sysmaint-split package while booted in PERSISTENT Mode | SYSMAINT Session | maintenance tasks (a special startup mode used for system changes). [1]
sudo dummy-dependency user-sysmaint-split
Kicksecure for Qubes
1. Qubes version specific.
- Qubes R4.2: Open a Qubes Root Console.
- Qubes R4.3 and above: Ensure that the
kicksecure-17Template is booted inPERSISTENT Mode | SYSMAINT Session | maintenance tasks(a special startup mode used for system changes).
2. Run:
sudo dummy-dependency user-sysmaint-split
3. Install qubes-core-agent-passwordless-root to allow the user account to elevate to root.
sudo apt install qubes-core-agent-passwordless-root
4. Shut down the Template.
5. Reboot any AppVMs that are based on the Template.
6. Done.
The process of removing user-sysmaint-split is now complete.
Impact of unrestricted admin mode[edit]
Uninstalling user-sysmaint-split removes the sysmaint mode-related GRUB boot menu modifications and reverts back to a "normal" boot menu. Unrestricted admin mode is now the default.
Security impact? This is hard to quantify. It is important to understand that user-sysmaint-split is an additional security feature, not a silver bullet.
The security concept of user versus administrative account isolation, implemented by the user-sysmaint-split package, is a standard feature on mainstream mobile operating systems such as Android and iOS. These mobile operating systems limit the rights of the device owner and reserve full administrative access for the device manufacturer (OEM). The purpose of this, among other security aspects, is to enforce mobile device restrictions, prioritizing the wishes of OEMs and application developers over user preferences. See also the General Threats to User Freedom wiki chapter Administrative Rights.
user-sysmaint-split improved security in many contexts. For example, if a user is using a dedicated virtual machine (VM) in a session only for web browsing, then there is no need for that VM to ever gain root rights. However, in other contexts such as on a server or development environment, user-sysmaint-split might offer little or no additional security, or degrade usability to unproductive levels.
There have been times when user-sysmaint-split was unavailable and nothing catastrophic occurred. At worst, this reduces the security level to Kicksecure versions equal to or lower than version 17.2.8.5.
See also Rationale for Protecting the Root Account.
Optional Restrictions[edit]
After removal, the user can configure sudo and/or other privilege escalation tools as usual.
Footnotes[edit]
- ↑
The
--purgeoption is optional and not required in this case when usingdummy-dependency, becauseuser-sysmaint-splithas been designed without configuration files in the/etcfolder. Instead,user-sysmaint-splituses symlinks, which are deleted upon removal. This design ensures that a standardapt remove user-sysmaint-splitwill not result in unexpected functionality, such as parts ofuser-sysmaint-split(e.g., boot menu entries) still being active.
A secure by default operating system with the latest security research in place.
At
Kicksecure we value freedom and trust, supporting Open Source and Freedom Software
2012-
2025 ENCRYPTED SUPPORT LLC
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!