Can I give certain applications their own rights, e.g. passwords, different from root password?

The reason I want to do this is, apps like compiz, settings manager, that don't need root access. This creates a problem when I show others Ubuntu or let them use it. They may think playing something like this is fine, as it looks like it just changes some effect but the reality is it could break Ubuntu if misused.

I would like others to just use my profile but apps like this make it a risk.

So is this possible?

  • 3
    I would recommend you to allow others to use the guest session instead of your session. – devav2 Sep 15 '12 at 17:52
  • I would like users to still have root access for installing programs or accessing drive partitions but just lock them out of certain programs – Mark Kirby Sep 16 '12 at 10:25
  • you could add a new group, and set the rights accordingly – mcantsin Mar 23 '14 at 2:46
  • 2
    A user with root access can do anything she wants on the system. So the two requirements - having root access but not being able to use some command - are incompatible. – Rmano Mar 23 '14 at 4:53

You can prevent users from editing application configuration files, if you transfer their ownership to another user, e. g.

sudo chown -R root:lusername ~lusername/.config/compiz-1
sudo chmod -R go-w,g+rX ~lusername/.config/compiz-1
  • I like this one. – Kaz Wolfe Sep 10 '14 at 3:42

In general it's possible, but not in the way you want to go about it.

See, when you run an app, it runs under your user id. So you can certainly set it up so that compiz runs under a different user, but then it wouldn't be running within your user's session and thus couldn't manage your users windows which would defeat the purpose of having compiz.

You can certainly create different users and make those users "own" specific applications and make it so only that user could run them. But it would require a huge amount of effort to do that with the built in Ubuntu apps and most of them need to run within your users session to work properly which means they won't work if they are running under a separate id.

The best way to solve your particular problem is to set up a separate user id with no admin rights just for your demonstration purposes. Then the worst they can do is break that particular users profile. You can also copy profiles so if it gets hosed you can just delete it and copy your template profile back in.


Not very quick for a casual demo but I think the best you can do is to create new users for them (or maybe only 1 other user for all) and configure limited sudo rights with visudo. See sudoers

Obs: changing the user or rights on specifics aplications will probably create a lot of problems for you and won't protect them against root and if you want to allow installation, your users need root rights (sudo).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.