Tag Info

Hot answers tagged

34

Most unix systems prevent users from “giving away” files, that is, users may only run chown if they have the target user and group privileges. Since using chown requires owning the file or being root (users can never appropriate other users' files), only root can run chown to change a file's owner to another user. The reason for this restriction is that ...


25

The functionality you are looking for seems to be implemented in glibc. You can define a custom hosts file using the HOSTALIASES environment variable. Here is a modified example from http://blog.tremily.us/posts/HOSTALIASES/ that works on my system (Ubuntu 13.10): $ echo 'g www.google.com' >> ~/.hosts $ export HOSTALIASES=~/.hosts $ wget g -O ...


24

I was looking for a way to run a program with modified DNS resolution for testing purposes. For me, the solution was using the HOSTALIASES environment variable: $ echo "foo www.google.com" >> ~/.hosts $ HOSTALIASES=~/.hosts $ wget foo See hostname(7).


22

ulimit is made for this. You can setup defaults for ulimit on a per user or a per group basis in /etc/security/limits.conf ulimit -v KBYTES sets max virtual memory size. I don't think you can give a max amount of swap. It's just a limit on the amount of virtual memory the user can use. So you limits.conf would have the line (to a maximum of 4G of ...


20

Binary packages are compiled with the assumption that they will be installed to specific locations in /. This is not always easily changed, and it would take additional QA effort (which is difficult enough in the first place!) to determine whether specific binaries are or aren't relocatable. To an extent, you can use things like fakechroot to create an ...


19

As far as I know there isn't. The easiest way to do what I think you want is to write an LD_PRELOAD library that overrides gethostbyname() and related functions.


19

In general, if a non-system installed and maintained binary needs to be accessible system-wide to multiple users, it should be placed by an administrator into /usr/local/bin. There is a complete hierarchy under /usr/local that is generally used for locally compiled and installed software packages. If you are the only user of a binary, installing into ...


17

Version control system is a program like any other. You can install it system-wide or locally if you like. Read the first two lines of GIT installation instructions for example. Also, if you are going to build anything to run as normal user, you might be interested in the question about running your own programs.


16

More similar Qs with more answers worth attention: http://stackoverflow.com/q/3859710/94687 http://stackoverflow.com/q/4410447/94687 http://stackoverflow.com/q/4249063/94687 http://stackoverflow.com/q/1019707/94687 some of the answers there point to specific solutions not yet mentioned here. (Actually, there are quite a few jailing tools with ...


14

There's a package manager project--Nix--with an interesting foundational idea (a "functional" pkg manager), which also supports a per-user operation: Multi-user support Starting at version 0.11, Nix has multi-user support. This means that non-privileged users can securely install software. Each user can have a different profile, a set of ...


12

I've successfully extracted the Fedora/OpenSUSE RPM into my home directory and ran chrome from there. You simply need to make sure that the symlinks for the libraries are all there. This assumes that the libraries area already installed, and $HOME/bin is in my $PATH. I just ran: mkdir ~/chrome; cd ~/chrome rpm2cpio ...


11

Beside the LD_PRELOAD tricks. A simple alternative that may work on a few systems would be to binary-edit a copy of the system library that handles hostname resolution to replace /etc/hosts with a path of your own. For instance, on Linux: If you're not using nscd, copy libnss_files.so to some location of your own like: mkdir -p -- ~/lib && cp ...


10

you can install it locally in your home directory. Ususally it can be done by specifying the parameter prefix for configure script. For example, ./configure --prefix=$HOME So, when you compile sources configured in such way, then you will call ** make install** the binaries will install into you $HOME/bin Also, you should alternate PATH variable. You ...


9

You can write a wrapper around the libc function to resolve hostnames and look them up in a different file than /etc/hosts. Then run any application you'd like to use your hosts file with LD_PRELOAD=wrapper.so firefox


9

If your system uses PAM, the login denial when /etc/nologin exists is triggered by the pam_nologin module. You can skip the pam_nologin invocation for users matching certain criteria with pam_succeed_if. For example, if you want to allow users in the adm group to log in on a text console even if /etc/nologin exists, add the following line to ...


9

Davfs2 isn't implemented like a normal FUSE filesystem. The Wikipedia page and the documentation mention that it can work on top of either Coda or FUSE, but the project description doesn't mention FUSE (and hints at native integration). The Debian package does not depend on FUSE, and the binary it ships only runs as root. This is not intrinsic to WebDAV, ...


9

It is impossible to completely prevent such attacks, at least without any major system reengineering and a heavy burden on the user. If an attacker has write access to your account, then the user can create a mock environment that hides all traces of the compromise to your eyes. The most obvious way is to use LD_PRELOAD to load a library that hides itself ...


9

You need to compile these from source. It should just be a matter of apt-get source PACKAGE ./configure --prefix=$HOME/myapps make make install The binary would then be located in ~/myapps/bin. Of course, this assumes that gcc is installed on the system.


9

Compile and install into ~/bin (and edit your .bashrc to set the PATH to include it). libraries can similarly be compiled and installed into ~/lib (set LD_LIBRARY_PATH to point to it), and development headers can be installed into e.g. ~/includes. Depending on the specific details of the programs you want to install and the libraries they depend upon, you ...


8

This is a fundamental limitation of the unix permission model: only root can delegate. You don't need to be root to run a virtual machine (not true of all VM technologies), but this is a heavyweight solution. User-mode Linux is a relatively lightweight Linux-on-Linux virtualization solution. It's not that easy to set up; you'll need to populate a root ...


8

This is controlled by the PS1 environment variable. You can see what this is by running, as root, echo $PS1. You can then set the variable in your own bash profile with echo 'PS1=<value of PS1>' >> ~/.bashrc. You can google for lots of possible values of PS1, but the part you are currently missing is \w for working directory.


8

There are a couple approaches, some of them mostly secure, others not at all. The insecure way Let any use run mount, e.g., through sudo. You might as well give them root; it's the same thing. The user could mount a filesystem with a suid root copy of bash—running that instantly gives root (likely without any logging, beyond the fact that mount was run). ...


8

fdisk -l can just list the filesystems it has the permission to read on. See my test with strace: user@host:~/test$ strace -e open /sbin/fdisk -l ... open("/proc/partitions", O_RDONLY) = 3 open("/dev/sda", O_RDONLY) = -1 EACCES (Permission denied) open("/dev/sda1", O_RDONLY) = -1 EACCES (Permission denied) open("/dev/sda2", ...


8

This is possible for syslinux: syslinux ~/floppy.ima The syslinux installer contains enough magic to be run on an unmounted filesystem. (In fact, it is designed to do that.) The extlinux installer expects to be run on a mounted filesystem, though. It is almost certainly possible to split off the extlinux installer into a part that copies the files ...


8

The sudoers file allows specifying commands to permit: username ALL=(root) NOPASSWD: /bin/foo bar baz Here username is the user you want to permit, and the command goes at the end of the line. If you specify arguments to the command, the user can only run it with exactly those arguments, but if you don't specify them here, the user can run the command ...


7

The right to access a serial port is determined by the permissions of the device file (e.g. /dev/ttyS0). So all you need to do is either arrange for the device to be owned by you, or (better) put yourself in the group that owns the device, or (if Fedora supports it, which I think it does) arrange for the device to belong to the user who's logged in on the ...


7

It depends what you mean by "install". It is possible to extract the file contents of a .deb file using dpkg-deb -x <filename.deb>, but whether you can actually use the software after extracting it locally depends on how it is written. A lot of Linux software will be expecting to find its resource files in standard locations specified at compile-time, ...


7

The pam_limits.so module can help you there. It allows you to set certain limits on specific individual users and groups or wildcards or ranges of users and groups. The limits you can set are typically ulimit settings but also on the number of concurrent login sessions, processes, CPU time, default priority and maximum priority (renice). Check the ...


7

@chaos and @Braiam have provided good answers on why you aren't getting the behavior you are looking for from fdisk when running as a non-root user. The simple fact is that allowing regular users to read disks directly would allow bypassing file permissions by simply reading the disk data directly, which could be a major problem and certainly would make file ...


6

Any real virtualization needs low-level access to the CPU, and thus root must install it. Once installed you don't need to be root to run it. You could probably install and run an emulator as non-root, such as bochs, or an adapter such as wine. If you have a specific Windows app in mind you could just run it under wine (maybe).



Only top voted, non community-wiki answers of a minimum length are eligible