up vote 1 down vote favorite
share [g+] share [fb]

I am creating a test system that will be run by others. It will have some kernel mods, and some of the default software in /usr/bin will be replaced. Because of this, I want to prevent the users from doing "sudo apt-get update" or "sudo apt-get install". These systems will not have any valuable data, and will mostly be behind corporate firewalls, and thus it is safe to completely punt on security-based releases.

FWIW, moving apt-* and dpkg* to /usr/dontusethese does not work because some other processes like (gag) MOTD updating relies on them being in /usr/bin and whine if they are not there.

link|improve this question
67% accept rate
feedback

1 Answer

up vote 8 down vote accepted

Just configure /etc/sudoers appropriately so that only authorized users can run apt-get.

link|improve this answer
1  
Doh, or that would work just as well as my response. – peelman Oct 14 '10 at 18:44
2  
Prohibiting users from doing an action is a better solution than masking the update action by removing the repositories. – Chris Oct 14 '10 at 18:55
1  
To close the loop, since people like recipes, here is what works well: "adminuser ALL = NOPASSWD: ALL, !/usr/bin/apt*, !/usr/bin/dpkg*" – Paul Hoffman Oct 16 '10 at 16:13
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.