Latest LQ Deal: Linux Power User Bundle
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 04-17-2007, 01:37 PM   #1
LQ Newbie
Registered: Apr 2007
Posts: 2

Rep: Reputation: 0
securing an executable some users may USE it, but not COPY it.

I hope someone out there can give me some tips on my current conundrum.

We're getting a new piece of analysis software here. A government agency is allowing our foreign national employees to use the software as long as it's installed on a server and:

1) the source code cannot be read or copied
2) the executable can be executed, but cannot be copied.

I know how to prevent a user from reading and copying the source code, but how do I prevent a user from copying an executable? This seems tough to do. We can argue that it will be useless without the linked libraries, but it feasible that someone could re-install it on a similarly configured system.

I'm not exactly sure what the nature of this new software is, but I'm guessing that it's going to be sent to us as C or FORTRAN source code. We are waiting for more information.

I'm using RHEL4. I consider myself to be moderately competent, but not a expert with Linux. Thanks for any advice/ideas.
Old 04-17-2007, 02:00 PM   #2
LQ Guru
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, CoreOS, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 7,064
Blog Entries: 14

Rep: Reputation: 1248Reputation: 1248Reputation: 1248Reputation: 1248Reputation: 1248Reputation: 1248Reputation: 1248Reputation: 1248Reputation: 1248
Of course there is basic permissions (man chmod): read, write, execute. Setting only execute and not read might work. Often directory permissions might allow them to do read/copy that the file permissions don't allow for.

You could investigate Access Control Lists (ACLs) that are more granular control for files than standard permissions (man setfacl).

However, if it were me in your shoes I'd probably:
A) Insure no one there had root access.
B) Setup sudo to do the execution. That way the user
-Has to input a password when he uses sudo
-Only executes sudo which in turn executes the program

Since sudo by default runs as root you could give permissions ONLY to root for read and execute. No one could read it then except root. Since sudo deals with execute rather than read they would not be able to read it even using the sudo command.

Also it doesn't HAVE to run as root. You could create an admin user and have them do a sudo command that su's to that admin user and executes it as that admin user. Here again you'd want to make sure no one had direct access to login as the admin user and that permissions were restricted to read and execute only for the admin user.
Old 04-17-2007, 02:49 PM   #3
Senior Member
Registered: Nov 2003
Location: Knoxville, TN
Distribution: Kubuntu 9.04
Posts: 1,168

Rep: Reputation: 53
Could you use something like X forwarding over ssh? That would keep everything executing on the server-side. If it's going to run client-side I really don't see how you can avoid copying it over the network.

Last edited by Crito; 04-17-2007 at 02:50 PM.
Old 04-17-2007, 02:57 PM   #4
LQ Guru
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 124Reputation: 124
You can set just the execute permissions on a program for a user. The file then cannot be read/copied/etc, but can be run.
Old 04-17-2007, 03:30 PM   #5
LQ Newbie
Registered: Apr 2007
Posts: 2

Original Poster
Rep: Reputation: 0
setting only the execute bit works

thanks for the rapid suggestions!

I experimented with these. At first, setting just the execute bit wasn't working... but, i was (stupidly) testing it with a simple Perl script... It took me a while to figure out that the read bit must be set to in order for /usr/bin/perl to interpret the code.

I tested it on a compiled C++ program and it works perfectly. When another user tried to copy the executable, it just complains:

cp: cannot open `/home/wsimmons/test/Hello' for reading: Permission denied

Thanks for the help.


administration, security

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Can I just copy an executable libray to Linux and expect it to work? john3 Linux - Software 3 03-26-2006 11:41 AM
securing users to certain directories ? lozza1978 Linux - Newbie 2 05-09-2005 11:04 PM
How to make a firefox executable available to all users bigfatdud Linux - Newbie 5 12-28-2004 07:08 PM
copy users to second PC deweirdt Linux - Software 4 02-06-2004 08:36 AM
How to copy one file in all users directories aizkorri Programming 1 09-02-2002 08:32 AM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 01:39 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration