Block access to specific applications

Question

I would like to give several users rights to a computer running Ubuntu to do most administrative functions such as add/remove programs, save files, make settings changes, etc. However, I would like to block them from using several specific applications. Is this possible, and how would I do so?

To provide a bit more detail: I am trying to set up Gnome Nanny to block adult websites from my kids' computer. I'd like to give them full access to the computer ACCEPT for Gnome Nanny. Windows has a program called K9 that cannot be turned off or uninstalled unless the user has the password EVEN if the user is an admin.

Sounds like this isn't available on Ubuntu without a rather involved process of setting permissions on a large list of applications and functions to mimic admin rights.

Answer 1

As long as you can make settings changes, you are omnipotent. To add remove program, you can grant sudo rights for aptitude and apt-get (not synaptic as it permits to add repositories). But this is not real security.

If you know specific resources that they need access, it is different.

By the way, as long as they can reboot and change the kernel command in grub, they are omnipotent. As long as they can reboot in another medium (USB key, Live-CD, PXE,...), same thing. If they can open the hardware and extract the hard disk... ditto. Securing a computer is not easy at all. If you just need to put enough fences around some adventurous users, you can't.

EDIT reply:

If your kids are computer geeks, there is no way with technical tricks to be sure they do only want you allow them to do, even those advertised as not-uninstallable (install a virtual machine and tor). If you look at dictatorship or at actual revolutions in North Africa, the only way the countries have found to block unwanted behavior was to shutdown Internet connexions and it seams to be insufficient. In the same way, the only thing you can do it shutdown Internet or the computer. And even like that, they can see it at friends.

What follows is not really an Ubuntu answer, but I care about children and I hope this can help. My best solution is education:

• Warn them about what they can and can't do, where are your limits.
• Acknowledge to them you can't and don't want to survey everything they do. You can log everything they do, but really, it is putting a spycam in their lives.
• Explain them what is a sexual predator and how they act. (soon)
• Show them what is an indelible trace on the internet and on social networks. Visual chats are recordable and most new computer have a webcam.
• Put a good advertisement blocking plugin.
• Oh, I didn't say it to you before, but they will go to pornographic web sites (as soon as 10-12 year old for some of them). Here your best friend (in my point of view) is sexual education before they have seen one/too much and explain that they don't have to do everything that is done there.
• If you educate them to late, it will be less useful. The good time is up to you, in function of your and their situation.

Technology is not a solution for human interaction and I hope it will never be.

Answer 2

If I understand Gnome Nanny correctly, it only supports certain programs for the various things it checks and/or blocks.

If you allow them to install software, you're not in the clear by just stopping access to the Nanny.

That, and what @shellholic says about rebooting makes met think you might need to find another method. The preferred from my point of view would be the social one, making sure the kids don't view stuff they shouldn't because they shouldn't. but otherwise, you might want to filter your internet outside of the computer. (ofcourse, all sorts of proxy, ssl undsoweiter. tricks can circumvent that again....)

Answer 3

Since you have a specific program that you would like to curtail, change the read/write/execute permissions for that program (and maybe its files) for user-only (go-rwx). You can get the list of its files from Syntapic or Apt. Make sure that your children have their own account(s) and are not able to execute that program (including sudo privs). Your own account should have sudo privs to be able to call the program.