8

I want to restrict an application being opened under ordinary privileges. Only root shall run the application, so that contents wont be seen by others and they wont change anything.

3
  • @VRU I am not sure your link is a duplicate.
    – don.joey
    Jan 25, 2013 at 13:25
  • 1
    @VRU Since you can't dupe acros sites, we can definitely use a Q&A on this (unless we declare this off-topic, which I wouldn't).
    – user98085
    Jan 25, 2013 at 13:34
  • @GKUTTY for your reference stackoverflow.com/questions/527876/…
    – VRU
    Jan 25, 2013 at 18:35

1 Answer 1

2

There should be a better way to do this (maybe with AppArmor?) but you can always change the permissions of the executable. Suppose you want to disable access to nano. Their default permissions are as follows:

 ➜  ls -la /bin/nano
-rwxr-xr-x 1 root root 192008 Oct  1 15:12 /bin/nano

It can be executed by owner, group and others. To maintain only owner execution you can use

sudo chmod g-x /bin/nano
sudo chmod o-x /bin/nano

After this, if you execute it in a terminal as an ordinary user:

 ➜  nano
bash: /usr/bin/nano: Permission denied

Please note that this is not a bullet-proof solution. If the application you want to lock has other entry points they could still be accessed. For example, if you tried the same trick with Firefox:

 ➜  ls -la /usr/bin/firefox
lrwxrwxrwx 1 root root 25 Jan 17 08:26 /usr/bin/firefox -> ../lib/firefox/firefox.sh

Even if you limited access to /usr/bin/firefox, as it is just a link to /usr/lib/firefox/firefox.sh it could be still be executed by there (or using /usr/lib/firefox/firefox, which is used in the .sh file).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .