LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-06-2011, 01:40 AM   #1
mmhs
Member
 
Registered: Oct 2010
Posts: 99

Rep: Reputation: 1
Prevent Run command


hi guys

what is the best way to prevent some user run some command ??

for example every body can run at and batch command and 3 or 4 special users prevent run these command ??
 
Old 08-06-2011, 01:56 AM   #2
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,066
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
You could chgrp those files to a specific group, make it not executable for that
group, and add those users to that group. This may get broken when the executables
get updated.

Or you could investigate SELinux policies to achieve what you're trying to do.


Cheers,
Tink
 
Old 08-06-2011, 02:02 AM   #3
mmhs
Member
 
Registered: Oct 2010
Posts: 99

Original Poster
Rep: Reputation: 1
Quote:
Originally Posted by Tinkster View Post
You could chgrp those files to a specific group, make it not executable for that
group, and add those users to that group. This may get broken when the executables
get updated.

Or you could investigate SELinux policies to achieve what you're trying to do.


Cheers,
Tink
i think it isn't good way because in this solution we should add all existing user to specific group and it gets long time but thx man for your solution
 
Old 08-06-2011, 02:04 AM   #4
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,066
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
No, you aren't listening ... make a group e.g., noat
chgrp noat /bin/at
chmod g-x /bin/at


That way anyone in the noat group can't run it, because perms
get evaluated left to right. If at stays
-rwxr--r-x
only people in noat can't run it, everyone else can.
 
1 members found this post helpful.
Old 08-06-2011, 02:06 AM   #5
mmhs
Member
 
Registered: Oct 2010
Posts: 99

Original Poster
Rep: Reputation: 1
Quote:
Originally Posted by Tinkster View Post
No, you aren't listening ... make a group e.g., noat
chgrp noat /bin/at
chmod g-x /bin/at


That way anyone in the noat group can't run it, because perms
get evaluated left to right. If at stays
-rwxr--r-x
only people in noat can't run it, everyone else can.
yeah that's right thx man
 
Old 08-06-2011, 02:09 AM   #6
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,066
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Pleasure.
 
Old 08-06-2011, 02:11 AM   #7
mmhs
Member
 
Registered: Oct 2010
Posts: 99

Original Poster
Rep: Reputation: 1
Quote:
Originally Posted by Tinkster View Post
No, you aren't listening ... make a group e.g., noat
chgrp noat /bin/at
chmod g-x /bin/at


That way anyone in the noat group can't run it, because perms
get evaluated left to right. If at stays
-rwxr--r-x
only people in noat can't run it, everyone else can.
and what about access control list ?? i think it can be better ?
 
Old 08-06-2011, 02:16 AM   #8
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,066
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
If your distro/file-system supports these, that would work, too.
The method above is the "smallest common denominator", should
work on any POSIX compliant Unix/Linux OS.


Cheers,
Tink

Last edited by Tinkster; 08-06-2011 at 02:17 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how to prevent move command in linux pbhagwat Linux - Newbie 1 07-30-2011 03:17 PM
[SOLVED] ssh: how to prevent disconnection after a command ? yobbas Linux - Server 4 08-19-2010 09:43 AM
Any way to prevent a command (./round) from being executed? rboc Linux - Security 15 02-23-2009 04:25 PM
How to prevent others from remotely logging into my pc through ssh command? CPurnima Linux - Newbie 7 11-26-2008 09:10 AM
prevent users to run the same script at the same time, on the same machine pvpnguyen Programming 2 09-05-2007 09:52 PM


All times are GMT -5. The time now is 10:09 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration