WRT Sudo and sudoers, with Fedora Workstation and subsequent release variants such as Silverlbue, since F2? it has been standard practice to have the user part of the “wheel” group which provides some limited admin capabilities. Aside from this, the system updates in an entirely atomic fashion, as @siosm explained here in his comment https://discussion.fedoraproject.org/t/toolbox-and-access-to-file-systems/28872/9. What this means at the functional level is that for most tasks the normal user rights will suffice to accomplish them and thus reduce your systems attack surface as an added security benefit. Also, since it is sort of offered as a container based workflow facilitating OS, all the container tools such as Podman Buildah and Skopeo work rootless, which again adds to your system security through another reduction of root access to the containers they build/manage/inspect. It also has the added benefit of reducing the user’s use of sudo, and essentially eliminates the use of root privileges for normal daily development work.
1 Like