how would i allow non-root users to install, but only from a repo

Question

i would like people on my system to install packages as long as it is always from a repo, and not a .deb package,or tar.gz,etc. how would i go about this? a good example of this would be to allow, say apt install firefox, but not apt-get install ./firefox.deb

Answer 1

You can blacklist all the packages ending in ".deb". To do so you need to modify your "Never-MarkAuto-Sections" block in /etc/apt/apt.conf.d/01autoremove file.

sudo nano /etc/apt/apt.conf.d/01autoremove

The content of "Never-MarkAuto-Sections" should look like this:

  Never-MarkAuto-Sections
  {
    "metapackages";
    "contrib/metapackages";
    "non-free/metapackages";
    "restricted/metapackages";
    "universe/metapackages";
    "multiverse/metapackages";
  };

Add another entry at the end:

  Never-MarkAuto-Sections
  {
    "metapackages";
    "contrib/metapackages";
    "non-free/metapackages";
    "restricted/metapackages";
    "universe/metapackages";
    "multiverse/metapackages";
    "*.deb";
  };