Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to allow non-root users to install packages system-wide using apt or rpm?

The place where I work currently has an out of date setup on the linux boxes, and admins are sick of having to do all the installations for users on request, so they are thinking of giving full sudo rights to all users. This has obvious security disadvantages. So I'm wondering if there's a way to allow normal users to install software - and to upgrade and remove it?

share|improve this question
1  
If you give privileges to install packages, you have essentially given full admin rights, since a user could just install a package with a setuid-root shell. –  camh May 29 '12 at 10:51
    
@camh hrm.. you could have a vetted repository, and not let users add new repositories, no? Or does apt allow you to install packages from .deb files? I realise a vetted repo would probably be more work in the long-run, this is more of a conceptual question :) –  naught101 May 29 '12 at 13:25
1  
apt-secure(8) says: "apt-get will currently only warn for unsigned archives, future releases might force all sources to be verified before downloading packages from them". Depending on how sophisticated an attack is, it could be possible to hijack the connection to the repository source and inject an untrusted package. However, read that man page for more details. You may have a secure enough solution for your thread model. –  camh May 29 '12 at 15:21
    
Related: User-local package management system –  Piotr Dobrogost Feb 25 '13 at 11:04
    
Related: Non-Root Package Managers –  Piotr Dobrogost Feb 26 '13 at 20:22
show 1 more comment

4 Answers

up vote 4 down vote accepted

You can specify the allowed commands with sudo, you don't have to allow unlimited access, e.g.

username ALL = NOPASSWD : /usr/bin/apt-get , /usr/bin/aptitude

This would allow username to run sudo apt-get and sudo aptitude without any password but would not allow any other commands.

You can also use packagekit combined with PolicyKit for some more finer level of control than sudo.

Allowing users to install/remove packages can be a risk. They can pretty easily render a system nonfunctional just by uninstalling necessary software like libc6, dpkg, rpm etc. Installing arbitrary software from the defined archives may allow attackers to install outdated or exploitable software and gain root access. The main question in my opinion is how much do you trust your employees?

Of course your admin team could also start using a configuration management system like puppet, chef or look into spacewalk to manage your system. This would allow them to configure and manage the system from a central system.

share|improve this answer
    
I left it out of my question, but do you have any comments on the security reduction implied by allowing this? I mean, you can't change the package repositories, so you're probably not going to get full sudo access, but you can write to any file using aptitude (options > preferences > "File to log actions into"), which could cause some serious damage. I'm less certain about PolicyKit... –  naught101 May 29 '12 at 4:41
1  
@naught101 ok i added some comments about security. JFTR as policykit won't provide root access it would be less problematic than using sudo –  Ulrich Dangel May 29 '12 at 10:31
add comment

aptdcon

From the man pages:

aptdcon: allows to perform package management tasks, e.g. installing or removing software, using aptdaemon. There isn't any need to be root to run this program.

share|improve this answer
add comment
username ALL = NOPASSWD : /usr/bin/yum, /bin/rpm
share|improve this answer
add comment

I also looked for something like that, but nothing showed up, so I coded this easy solution "softwarechannels":

https://github.com/alfem/softwarechannels

It is a very simple system to allow common (no admin) users to install packages from restricted catalogs.

Just define 'channels' (groups of packages) in a simple text file and give your users permissions to launch softwarechannels.

They will only see packages in channels matching their unix groups.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.