Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu desktop set up in a retail environment. I would like to restrict access to firefox. So that users must type in a password to run it. I tried changing permissions on the binary so that it did not have world access, but each time the update runs, those permissions get reset to world access.

Its convenient to have it available but its not strictly necessary for the software that the machine must run. so if it isn't possible to restrict it, then I can uninstall it if it won't impact functioning of the system. Would it impact the system to uninstall it?

share|improve this question
up vote 1 down vote accepted

I don't think any other package would depend on it; when you do an apt-get remove it will tell you if it would remove anything else.

In order to preserve permissions across updates, you need to use the dpkg-statoverride command.


dpkg-statoverride --add owner:group 750 firefox

share|improve this answer
Does dpkg-statoverride need to be run just once? – Bill May 3 '12 at 3:00
One thing people could do is download and run a binary for firefox without installing it. Restricting this would be very intrusive. – Falcon Momot May 3 '12 at 4:21
@Bill yes just one time per folder/file and it will be remembered forever for that package. – Jeremy May 3 '12 at 11:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.