How do you prevent user from opening a program?

Question

I'm trying to write a script which prevents the concerned user from opening programs (mostly internet browsers) from being run during a certain time (like 1000 to 1200 hrs). This is like a productivity suite. I don't have much problems implementing the timing problem or the user problem. My problem lies in the prevention of task execution.

My question is: How do I stop a process before it starts?

Right now, I have an infinite loop implementation with a pseudo-code as :

while(1)
killall midori
killall firefox
sleep(60s)
end 

But this is taxing on the computer and I don't want to stop a task if it starts, I want to prevent the task from starting in the first place.

Answer 1

There are several methods:

1. Remove the executables that you want to limit from locally attached storage on all workstations and make them accessible only on a network drive that you control

2. Use SELinux policy to limit execution per workstation

3. Limit access to the ports, IP addresses or other resources that the offending executables need using proxies or just iptables

None of these methods will be effective without first implementing a well explained usage policy agreement that users must sign.