Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to prevent users from running certain programs on their Linux computers? Is there a whitelist method? A blacklist?

share|improve this question

6 Answers 6

up vote 7 down vote accepted

The simple solution may be to simply remove execute permissions on system binaries. If you want to prevent users from compiling things or running things from directories they have write access you can create a separate partition and mount those file-systems with the noexec option.

man mount (noexec option)

Do not allow direct execution of any binaries on the mounted file system. (Until recently it was possible to run binaries anyway using a command like /lib/ld*.so /mnt/binary. This trick fails since Linux 2.4.25 / 2.6.0.)

I believe another way to accomplish this you would need to use something like AppArmor or SELinux.

share|improve this answer
    
And I want to prevent users from making executables on their own home dirs. It seems there's no simple way to accomplish this. Apparently AppArmor and SELinux, although they appear to provide the means to accomplish it, have a broader usage scope, so they're quite complex. Thanks for pointing them out. –  Ivan May 16 '09 at 1:45
1  
noexec may help prevent most of the running of things form their folders. I have updated my answer. –  Zoredache May 16 '09 at 2:59

The answer to this depends on if you want a blacklist or whitelist solution.

Whitelist is actually fairly easy. Use the same approach that Ubuntu and many other distros use. Create a group for a particular program or group of programs, set the group of the executable to that and then add users to that group if you want them to be able to access it. This is how access to sudo, printers and a whole host of other things are done on Ubuntu (and other distros).

Blacklist is actually harder but that's not such a bad thing imho. Blacklist I think is inherently less secure. In fact I can't really think of a way of doing it that doesn't treat is like a pseudo-whitelist ie everyone is a member of the relevant group and you just remove those you don't want.

share|improve this answer
    
That's a good approach, but what about users executing their own programs? –  Ivan May 16 '09 at 2:34

Use groups and deny execute on the programs. Or are you looking for more than that?

share|improve this answer
    
How? What if a user copies something in it's home directory and makes it executable? –  Ivan May 16 '09 at 1:22
    
You could potentially deal with that by removing read permissions as well... I think something with a mode like 0110 (--x--x---) or 0510 (r-x--x---) can only be executed, not copied. Not 100% sure though. –  David Z May 16 '09 at 2:48

You can probably hack something together with standard *nix permissions and groups.

However, if you need something more than that, you probably want to google POSIX ACLs. Most (all?) major Linux filesystems support them, and they give you a lot of additional control and granularity.

share|improve this answer

If you want to give people limited shell access, take a look at rbash. It offers various limitations to the user. Also take a look at PAM's limits.conf (/etc/securit/limits.conf on Ubuntu). The third option is creating a jail/chroot environment for your users where you decide exactly what binaries and libraries they have access to.

Others have also pointed out using permissions, noexec and ACL to achieve this. Really depends on your needs, what solution is the best.

share|improve this answer

Probably not. It depends on what "certain programs" means. If a user has an interactive shell that is useful, they can install almost any software they want. But if you don't want them to be able to run a particular copy of software you have already installed, ordinary file permissions will work just fine. For example, create a group "xmmsblacklist", chmod 705 /usr/bin/xmms, chgrp xmmsblacklist /usr/bin/xmms, and add the users to that group.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.