Member Avatar for RikTelner

I installed Qt, again, on new installation of Ubuntu. It asked me for sudo password, which is not strange since it wants to write it's data in kind of restricted environment. But what if some cracker, has embedded a virus and went of distributing working software from trustworthy company, but when you start it, it also starts sequence of things that you don't want on your computer?

On Windows there was a verification, that whenever program asks you for administrator permission, you could kind of see that the installation file is trustworthy because not a single byte has been changed, the "Author: Google Inc." and block is colored blue, not yellow. Is there a way to have same in Linux? I don't need boxes and button pressing, but is there a way to verify "is current running process that of which name I know, unchanged official redistributed installation file?".

I know I could check checksums, but, not every software developer is giving you official checksums and it also kind of takes time. Is there a way to verify running application that asks me for sudo password?

  • 3 Contributors
  • 4 Replies
  • 269 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by RikTelner

Dani AI

Generated

Short answer: Linux does not present a universal “verified publisher” badge the way Windows UAC sometimes does. The UI box that asked you for a password is just an authentication agent asking to elevate an action; it does not by itself prove the calling binary is the genuine vendor build. The reliable way to be sure is to verify the artifact or package before you grant root rights, or to run unknown installers in isolation so they can’t harm the host.

Practical checks and safer alternatives: prefer software from your distribution’s repositories or from confined app formats (snap, flatpak) because those systems include signature checks and publisher metadata. For third‑party bundles, require a cryptographic signature and verify the vendor’s public key/fingerprint via the vendor’s official channel before trusting it. If an installer is the only option, unpack and inspect it in an isolated environment (VM, container or an unprivileged sandbox) before running it with elevated privileges on your main system.

How to see what actually happened when you authenticating: systemd/journal and the authentication logs record which action requested elevation; the audit subsystem can record what the elevated process touched. After an install you can also use package-manager verification tools to compare installed files against the package’s signed metadata or integrity database to detect tampering.

Recommended workflow: build on the ideas already mentioned by and — prefer repository installs where the trust chain is automatic; treat simple file hashes as a fallback; insist on signed artifacts when available; and for anything unfamiliar, test it inside a VM or container or apply confinement (AppArmor/SELinux/Firejail) before giving it root. When in doubt, do not enter your password.

Recommended Answers

All 4 Replies

Member Avatar for rubberman

So, use sudo to change to root: sudo su -
Then, install the package. No passwords will be sent to any malware as a result. Checksums are good, and I think that Qt will provide those if you need.

Member Avatar for RikTelner

So, use sudo to change to root: sudo su -

?, it requested plain password, program gave me pop-up and asked me for sudo password.

Checksums are good, and I think that Qt will provide those if you need.

And in case I would need to download software from verified app developer, but doesn't provide checksums? Is there way to verify it?

Member Avatar for Slavi

I would doubt it if they don't provide at least md5 checksums

or do you mean how to find the checksum of the downloaded file? In this case md5sum is a command line utility to do that, should be inbuilt in ubuntu

Member Avatar for RikTelner

Okay, off with MD5 checksums, we're off to a wrong direction. The original question is:

"How to verify a package that requests sudo password?"

Forget everything I said about checksums.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.