Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm setting up a new user account, and I want to allow access to only certain programs for just that account. How would I go around doing that?

share|improve this question
    
You might want to explain what type of programs (e.g. are you talking about using a GUI or just commandline shell access?). –  JanC Oct 18 '10 at 19:35
    
Do you want the new account to be able to (1) execute only a part of the programs everyone else can use (e.g., you want the new user not to run Firefox), or do you want the new account to (2) run everything plus some programs of its own exclusive access? (I.e., in case 2. only the new account would be able to run program "foobar", other people would not.) –  Riccardo Murri Oct 18 '10 at 20:16
    
Any programs, and I want to 1) prevent them from running Firefox, for example. –  Lyrositor Oct 18 '10 at 23:24

2 Answers 2

up vote 8 down vote accepted

Here is a quick way to do it with firefox as an example:

  1. Create a group webusers
  2. change the rights of the firefox binary to 750 (root:rwx, webusers:r-x) and the ownership to root:webusers
  3. add all users who should be allowed to use firefox to the group webusers

You can, of course, create groups for all individual programs. Here are the commands for doing it.

sudo addgroup webusers
sudo chmod 750 /usr/bin/firefox
sudo chown root:webusers /usr/bin/firefox
adduser alice webusers
adduser bob webusers
share|improve this answer

You might want to have a look at Pessulus and Gnome Nanny to lock down user accounts.

To lock down specific programs you can use AppArmor. There is no simple configuration to accomplish what you want, but the official Wiki has a nice article on AppArmor: https://help.ubuntu.com/community/AppArmor

share|improve this answer
    
I tried Gnome Nanny, couldn't help. What's Pessulus? –  Lyrositor Oct 18 '10 at 23:27
    
Pessulus is the official Gnome Lockdown editor. –  mniess Oct 19 '10 at 14:21
    
Sorry, I want to control individual programs. –  Lyrositor Oct 20 '10 at 23:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.