android rooting and security

Question

I read here that the way to become "root" in an Android device(Galaxy S3) is to use Rooting. However it has been said that if we do that, even normal applications will be running with root privilege. Is that the case ? For anyone with a Unix background, I am sure that allowing all applications to run as root is quite odd and dangerous. So my question is, isn't there the concept of Users as we have it on a *nix system ? For eg: in a normal operation as what user the Android apps run ? (we are not logging in as we do on a *nix system, so is there a default user ?).

Also, is there no way to restrict or to run apps without root privilege ?

Since I am a Linux/Unix guy, I would really like to get the command line. That is why I want to do the Rooting. However, I dont' want to make my mobile phone that loose and make it a Virus system like Windows.

Answer 1

Every app is under its own user (this is how permissions are enforced). When you "root" a device, you add an SU binary which runs tasks as the super user. Any app can run the SU binary but they have to explicitly do so. Without explicitly doing so, they continue to run as their own user.

Most (if not all) rooting methods will have an additional APK for managing what apps have access to SU, such as SuperSU. In my experience, the first time an app tries to use SU, you'll get a notification asking for access. This will allow you to deny root to apps that request it.

EDIT: I'd also like to add that you can get command line access on Android without rooting. I highly recommend Terminal Emulator if you want access from your phone. If it's connected to a computer you can use ADB to run things on your phone by running adb shell. To get ADB, you'll need to get the Android SDK and find ADB in it.