Is it possible to prevent users from running certain programs on their Linux computers? Is there a whitelist method? A blacklist?
Add a comment
|
6 Answers
The simple solution may be to simply remove execute permissions on system binaries. If you want to prevent users from compiling things or running things from directories they have write access you can create a separate partition and mount those file-systems with the noexec option.
man mount (noexec option)
Do not allow direct execution of any binaries on the mounted file system. (Until recently it was possible to run binaries anyway using a command like /lib/ld*.so /mnt/binary. This trick fails since Linux 2.4.25 / 2.6.0.)
I believe another way to accomplish this you would need to use something like AppArmor or SELinux.
answered May 16, 2009 at 0:27
-
1And I want to prevent users from making executables on their own home dirs. It seems there's no simple way to accomplish this. Apparently AppArmor and SELinux, although they appear to provide the means to accomplish it, have a broader usage scope, so they're quite complex. Thanks for pointing them out.– IvanMay 16, 2009 at 1:45
-
1noexec may help prevent most of the running of things form their folders. I have updated my answer. May 16, 2009 at 2:59
The answer to this depends on if you want a blacklist or whitelist solution.
Whitelist is actually fairly easy. Use the same approach that Ubuntu and many other distros use. Create a group for a particular program or group of programs, set the group of the executable to that and then add users to that group if you want them to be able to access it. This is how access to sudo, printers and a whole host of other things are done on Ubuntu (and other distros).
Blacklist is actually harder but that's not such a bad thing imho. Blacklist I think is inherently less secure. In fact I can't really think of a way of doing it that doesn't treat is like a pseudo-whitelist ie everyone is a member of the relevant group and you just remove those you don't want.
-
That's a good approach, but what about users executing their own programs?– IvanMay 16, 2009 at 2:34
Use groups and deny execute on the programs. Or are you looking for more than that?
-
How? What if a user copies something in it's home directory and makes it executable?– IvanMay 16, 2009 at 1:22
-
You could potentially deal with that by removing read permissions as well... I think something with a mode like 0110 (--x--x---) or 0510 (r-x--x---) can only be executed, not copied. Not 100% sure though.– David ZMay 16, 2009 at 2:48
-
@DavidZ these permissions can work for (most) system binaries, however it will not work at all for scripts, as the script interpreter (bash, perl, python, etc.) must read them. moreover they can just obtain the executable somewhere else and copy it on the system over internet or a USB stick... having noexec on all partitions writable by users seems a better approach... that of course will not work for scripts.– AleDec 14, 2014 at 18:21
You can probably hack something together with standard *nix permissions and groups.
However, if you need something more than that, you probably want to google POSIX ACLs. Most (all?) major Linux filesystems support them, and they give you a lot of additional control and granularity.
answered May 16, 2009 at 0:40
If you want to give people limited shell access, take a look at rbash. It offers various limitations to the user. Also take a look at PAM's limits.conf (/etc/securit/limits.conf on Ubuntu). The third option is creating a jail/chroot environment for your users where you decide exactly what binaries and libraries they have access to.
Others have also pointed out using permissions, noexec and ACL to achieve this. Really depends on your needs, what solution is the best.
Probably not. It depends on what "certain programs" means. If a user has an interactive shell that is useful, they can install almost any software they want. But if you don't want them to be able to run a particular copy of software you have already installed, ordinary file permissions will work just fine. For example, create a group "xmmsblacklist", chmod 705 /usr/bin/xmms, chgrp xmmsblacklist /usr/bin/xmms, and add the users to that group.
