hi

howto write a script to protect the start of an application using password for example thunderbird ?

kind regards
cccc

would it be better to add specific users to a group and allow only them the permissions to execute the command in question?

yep, but cannot use it in my case and I need a script

ok sorry, hope someone can give you some insight then

I thought about this before. Encryption is the next thing that comes to mind after users/groups. Plus, even with users and groups the device could be mounted on another system and the binary copied. I'd do this:

1) create a small random file (maybe 3x the size of the binary itself)
2) loop the file using kernel encryption
3) create a file system on the loop
4) mount the loop and place your binary on the file system
5) unmount and unloop

In the script, all you have to do is loop/mount the encrypted file system image and execute the binary from it. If you need more specific help, let me know. Do you have kernel 2.6?
ta0kira

I believe a script in this case would be next to useless, as it relies on obfuscating the true location of the executable so that the script is called instead and a password must be given. If anyone was able to examine the script they could learn the location of the true executable, or even if they knew the executable's filesize they might be able to find it.

That's why I suggested encryption. The script can make the losetup, dmcrypt, and mount calls while leaving the password up to the user. Anyone would be able to find the image, but no one would have the encryption password except the correct user, making it useless to anyone else.
ta0kira

For such script to be useful you need to restrict the access to the executable you want to protect so only the script can execute it, but not a regular user. You can store a hash of the password not the password itself (for example md5 hash), then the script should require the user to enter the password, compute its hash value and compare it with the one already stored, if they match the script should execute the protected executable. The stored hash value also must be accessible only from the script.

Usually the easiest way to restrict the access to the protected executable is to set apropriate ownership/permissions, but then instead of using your own script you can use sudo. See its man page.