LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-17-2007, 12:37 PM   #1
Rocket_Sci
LQ Newbie
 
Registered: Apr 2007
Posts: 2

Rep: Reputation: 0
securing an executable some users may USE it, but not COPY it.


I hope someone out there can give me some tips on my current conundrum.

We're getting a new piece of analysis software here. A government agency is allowing our foreign national employees to use the software as long as it's installed on a server and:

"
1) the source code cannot be read or copied
2) the executable can be executed, but cannot be copied.
"


I know how to prevent a user from reading and copying the source code, but how do I prevent a user from copying an executable? This seems tough to do. We can argue that it will be useless without the linked libraries, but it feasible that someone could re-install it on a similarly configured system.

I'm not exactly sure what the nature of this new software is, but I'm guessing that it's going to be sent to us as C or FORTRAN source code. We are waiting for more information.


I'm using RHEL4. I consider myself to be moderately competent, but not a expert with Linux. Thanks for any advice/ideas.
 
Old 04-17-2007, 01:00 PM   #2
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,009
Blog Entries: 5

Rep: Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787
Of course there is basic permissions (man chmod): read, write, execute. Setting only execute and not read might work. Often directory permissions might allow them to do read/copy that the file permissions don't allow for.

You could investigate Access Control Lists (ACLs) that are more granular control for files than standard permissions (man setfacl).

However, if it were me in your shoes I'd probably:
A) Insure no one there had root access.
B) Setup sudo to do the execution. That way the user
-Has to input a password when he uses sudo
-Only executes sudo which in turn executes the program

Since sudo by default runs as root you could give permissions ONLY to root for read and execute. No one could read it then except root. Since sudo deals with execute rather than read they would not be able to read it even using the sudo command.

Also it doesn't HAVE to run as root. You could create an admin user and have them do a sudo command that su's to that admin user and executes it as that admin user. Here again you'd want to make sure no one had direct access to login as the admin user and that permissions were restricted to read and execute only for the admin user.
 
Old 04-17-2007, 01:49 PM   #3
Crito
Senior Member
 
Registered: Nov 2003
Location: Knoxville, TN
Distribution: Kubuntu 9.04
Posts: 1,168

Rep: Reputation: 53
Could you use something like X forwarding over ssh? That would keep everything executing on the server-side. If it's going to run client-side I really don't see how you can avoid copying it over the network.

Last edited by Crito; 04-17-2007 at 01:50 PM.
 
Old 04-17-2007, 01:57 PM   #4
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
You can set just the execute permissions on a program for a user. The file then cannot be read/copied/etc, but can be run.
 
Old 04-17-2007, 02:30 PM   #5
Rocket_Sci
LQ Newbie
 
Registered: Apr 2007
Posts: 2

Original Poster
Rep: Reputation: 0
setting only the execute bit works

thanks for the rapid suggestions!

I experimented with these. At first, setting just the execute bit wasn't working... but, i was (stupidly) testing it with a simple Perl script... It took me a while to figure out that the read bit must be set to in order for /usr/bin/perl to interpret the code.

I tested it on a compiled C++ program and it works perfectly. When another user tried to copy the executable, it just complains:

cp: cannot open `/home/wsimmons/test/Hello' for reading: Permission denied

Thanks for the help.
 
  


Reply

Tags
administration, security


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Can I just copy an executable libray to Linux and expect it to work? john3 Linux - Software 3 03-26-2006 10:41 AM
securing users to certain directories ? lozza1978 Linux - Newbie 2 05-09-2005 10:04 PM
How to make a firefox executable available to all users bigfatdud Linux - Newbie 5 12-28-2004 06:08 PM
copy users to second PC deweirdt Linux - Software 4 02-06-2004 07:36 AM
How to copy one file in all users directories aizkorri Programming 1 09-02-2002 07:32 AM


All times are GMT -5. The time now is 05:29 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration