Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

I frequently work in an environment where, lets call them "pranksters" may gain access to my console.

I am diligent in locking my screen whenever I walk away, but given enough time someone gets the chance to type chmod -R 777 * while i'm looking the other way / sharpening a pencil / whatever.

Is there any way I can force re-entry of my password for certain commands (i'm thinking for rm, chmod, chown, vi ~/.bashrc, &c)?

I have thought of chmodding .bashrc and .bash_profile to read-only for all users (including myself) and then alias chown / chmod / whatever to a script that requires a password but that seems so hacky.

EDIT: I am not a sudoer on this machine

share|improve this question
3  
Something simple would be to do an alias chmod=/bin/true. This does not really add security but it might take too long for the prank to succeed. You still have easy access to the unaliased version with \chmod. – Marco Sep 8 '12 at 15:21
@Marco good idea, and @Patrick has a good version of that with copying true to the path. – trideceth12 Sep 8 '12 at 17:37

1 Answer

up vote 3 down vote

A few different ways pop into mind:

1)

Use filesystem ACLs to remove the execute permission from your user on these certain binaries. Then require the use of sudo to run them.

So for example, to prevent your user from executing chmod

setfacl -m u:trideceth12:- `which chmod`

Now any attempt to run chmod will result in a 'permission denied' error.

(The downside to this approach is that if the binaries get updated, the ACL will be reset. But you could put a simple check for the ACL in your shell startup script and warn you if it's missing.)

2)

As was mentioned in a comment, alias the commands to something else (such as yes, /bin/true to make it seem like the command worked).

3)

A slightly less easier to solve (but still easy) is to put a special directory in $PATH ahead of the normal search locations, and copy /bin/true into that directory as chmod. That way it won't appear as an alias.

Obviously #1 is the best solution as it actually does more than misdirect the user, it implements real security.

share|improve this answer
I should have specified that I am not a sudoer on this machine so solution one is not an option... but i love the idea of putting a copy of true in my path (just did it in fact) so +1 there. – trideceth12 Sep 8 '12 at 17:35
if they figure it out, they'll just start typing /bin/chmod -R 777 *. a technical solution to a non-technical problem is only likely to work in the short term. confront the children who are harassing you and, if you can not convince them to stop, report their behaviour and misuse of the computer equipment. if the person you would report to is one of the harassers or thinks it is "funny", then quit - the situation is unfixable. – Craig Sanders Sep 9 '12 at 0:56
a handful of pranks can be written off as 'a joke', but constant pranks are harassment. – Craig Sanders Sep 9 '12 at 0:58
@CraigSanders tbh it is not a big deal as it's never malicious, and you are right I could prevent it by intervening socially. I am still interested however in how to maintain some rudimentary security even with the intruder at my physical console. Setting permissions of vulnerable folders to 000 and securing chmod is they way I am currently leaning towards. But as you said they could just /bin/chmod or even bring a compatible chmod binary on usb! – trideceth12 Sep 9 '12 at 5:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.