user restrection launching such appz

Net_Spy · 01-23-2007, 06:08 AM

Greetings to all

guys some one have any idea how to restrict a user launch a such gui or console based application using pam module or any way of doing that.just like we restrich a user for launching a such command on bash same like that but to prevent launching other application that he doesnt have the permission when its launch them it ask for the password or just denied the access.im looking forward for your kind response.

Regards
Net_Spy

jschiwal · 01-23-2007, 08:01 AM

To use pam an application needs to be compiled with the libpam library. You can try checking if a program is with the ldd command.

For example:

Code:

ldd /bin/su
        libpam.so.0 => /lib64/libpam.so.0 (0x00002b6142189000)
        libpam_misc.so.0 => /lib64/libpam_misc.so.0 (0x00002b6142395000)
        libc.so.6 => /lib64/libc.so.6 (0x00002b6142599000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00002b61428dc000)
        libaudit.so.0 => /lib64/libaudit.so.0 (0x00002b6142ae0000)
        /lib64/ld-linux-x86-64.so.2 (0x0000555555554000)

Maybe you want to have the user run in a jail.

Net_Spy · 01-23-2007, 10:47 PM

Thanks for the reply here is the out put of ldd cmd but i mean if there is only executable file i got so how to do the password authentication using pam.Because pam use the share lib and it must b in /etc/pam.d or either must have the source code is there any other way to do it without having the source code.yeah may be they deserv to be in jail

.Now tell how would i acheive my goal to prevent my user launching such console based appzz which include mouse point enable aswell.when user launch it should ask for password from user and also limit my user for use the limited commands.Im sure you got my point

.lookig forward for your kind
response.

Response
Net_Spy

Code:

ldd /bin/su
        libpam.so.0 => /lib/libpam.so.0 (0x4002b000)
        libpam_misc.so.0 => /lib/libpam_misc.so.0 (0x40033000)
        libcrypt.so.1 => /lib/libcrypt.so.1 (0x40036000)
        libc.so.6 => /lib/tls/libc.so.6 (0x42000000)
        libdl.so.2 => /lib/libdl.so.2 (0x40063000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

unSpawn · 01-24-2007, 08:27 AM

Just a few questions if I may:
- what's the main reason for denying access?
- are we talking about one application or many?
- one or multiple users?
- users each having their own set of inaccessable applications?

And *please* clean up your replies. Without proper capitalisation and punctuation it's hard to read to the point where many here are not even willing to put in an effort so basically you'll only be hurting yourself, response-wise.

Net_Spy · 01-24-2007, 02:43 PM

Ansers of your questions are list below

1)security reasons.
2)Application is single thread
3)users are more then one
4)all user will user the single centeralized appz.

im sure now ya dont have any problem to understand it.

Regards
Net_Spy

jschiwal · 01-24-2007, 07:59 PM

Quote:

Originally Posted by Net_Spy

2)Application is single thread

So it is a single application that you want to control? I'm reading between the lines because you used "Application" which is singular and not plural. Being single thread isn't what was asked, but this and answer #4 indicate that you want to control a network service. Is that correct. If so what is the application.