I hope someone out there can give me some tips on my current conundrum.

We're getting a new piece of analysis software here. A government agency is allowing our foreign national employees to use the software as long as it's installed on a server and:

"
1) the source code cannot be read or copied
2) the executable can be executed, but cannot be copied.
"


I know how to prevent a user from reading and copying the source code, but how do I prevent a user from copying an executable? This seems tough to do. We can argue that it will be useless without the linked libraries, but it feasible that someone could re-install it on a similarly configured system.

I'm not exactly sure what the nature of this new software is, but I'm guessing that it's going to be sent to us as C or FORTRAN source code. We are waiting for more information.


I'm using RHEL4. I consider myself to be moderately competent, but not a expert with Linux. Thanks for any advice/ideas.

Of course there is basic permissions (man chmod): read, write, execute. Setting only execute and not read might work. Often directory permissions might allow them to do read/copy that the file permissions don't allow for.

You could investigate Access Control Lists (ACLs) that are more granular control for files than standard permissions (man setfacl).

However, if it were me in your shoes I'd probably:
A) Insure no one there had root access.
B) Setup sudo to do the execution. That way the user
-Has to input a password when he uses sudo
-Only executes sudo which in turn executes the program

Since sudo by default runs as root you could give permissions ONLY to root for read and execute. No one could read it then except root. Since sudo deals with execute rather than read they would not be able to read it even using the sudo command.

Also it doesn't HAVE to run as root. You could create an admin user and have them do a sudo command that su's to that admin user and executes it as that admin user. Here again you'd want to make sure no one had direct access to login as the admin user and that permissions were restricted to read and execute only for the admin user.

Could you use something like X forwarding over ssh? That would keep everything executing on the server-side. If it's going to run client-side I really don't see how you can avoid copying it over the network.

You can set just the execute permissions on a program for a user. The file then cannot be read/copied/etc, but can be run.

thanks for the rapid suggestions!

I experimented with these. At first, setting just the execute bit wasn't working... but, i was (stupidly) testing it with a simple Perl script... It took me a while to figure out that the read bit must be set to in order for /usr/bin/perl to interpret the code.

I tested it on a compiled C++ program and it works perfectly. When another user tried to copy the executable, it just complains:

cp: cannot open `/home/wsimmons/test/Hello' for reading: Permission denied

Thanks for the help.