Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying to write a script which prevents the concerned user from opening programs (mostly internet browsers) from being run during a certain time (like 1000 to 1200 hrs). This is like a productivity suite. I don't have much problems implementing the timing problem or the user problem. My problem lies in the prevention of task execution.

My question is: How do I stop a process before it starts?

Right now, I have an infinite loop implementation with a pseudo-code as :

while(1)
killall midori
killall firefox
sleep(60s)
end 

But this is taxing on the computer and I don't want to stop a task if it starts, I want to prevent the task from starting in the first place.

share|improve this question
    
What kind of stupidity is this? Your administration power made you feel like fascist fuhrer? If you need to prevent people executed a program, change owner-group and remove appropriate permission. Much better would be to define what is permitted inside a proxy (like squid). If you would kill my browser while I would be doing a work and I would lost data, I would escalate you and let you be fired ASAP! –  Jiri Xichtkniha Apr 10 '12 at 13:20
    
LOL. I re-read my question and I think I misled the audience, I am actually designing this as a productivity suite. –  user14517 Apr 10 '12 at 13:28
2  
If the user does cp `which midori` ~/mybrowser then your killall midori will solve nothing. This also stands for the permission manipulation mentioned by @Jiri. –  manatwork Apr 10 '12 at 13:41
1  
Filesystems can be mounted noexec ;) –  Jiri Xichtkniha Apr 10 '12 at 13:48
add comment

1 Answer

up vote 2 down vote accepted

There are several methods:

  1. Remove the executables that you want to limit from locally attached storage on all workstations and make them accessible only on a network drive that you control

  2. Use SELinux policy to limit execution per workstation

  3. Limit access to the ports, IP addresses or other resources that the offending executables need using proxies or just iptables

None of these methods will be effective without first implementing a well explained usage policy agreement that users must sign.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.