Hot answers tagged not-root-user
18
Most unix systems prevent users from “giving away” files, that is, users may only run chown if they have the target user and group privileges. Since using chown requires owning the file or being root (users can never appropriate other users' files), only root can run chown to change a file's owner to another user.
The reason for this restriction is that ...
17
Version control system is a program like any other. You can install it system-wide or locally if you like. Read the first two lines of GIT installation instructions for example.
Also, if you are going to build anything to run as normal user, you might be interested in the question about running your own programs.
15
Binary packages are compiled with the assumption that they will be installed to specific locations in /. This is not always easily changed, and it would take additional QA effort (which is difficult enough in the first place!) to determine whether specific binaries are or aren't relocatable.
To an extent, you can use things like fakechroot to create an ...
15
ulimit is made for this.
You can setup defaults for ulimit on a per user or a per group basis in
/etc/security/limits.conf
ulimit -v KBYTES sets max virtual memory size. I don't think you can give a max amount of swap. It's just a limit on the amount of virtual memory the user can use.
So you limits.conf would have the line (to a maximum of 4G of ...
14
In general, if a non-system installed and maintained binary needs to be accessible system-wide to multiple users, it should be placed by an administrator into /usr/local/bin. There is a complete hierarchy under /usr/local that is generally used for locally compiled and installed software packages.
If you are the only user of a binary, installing into ...
10
There's a package manager project--Nix--with an interesting foundational idea (a "functional" pkg manager), which also supports a per-user operation:
Multi-user support
Starting at version 0.11, Nix has
multi-user support. This means that
non-privileged users can securely
install software. Each user can have a
different profile, a set of ...
9
It is impossible to completely prevent such attacks, at least without any major system reengineering and a heavy burden on the user.
If an attacker has write access to your account, then the user can create a mock environment that hides all traces of the compromise to your eyes. The most obvious way is to use LD_PRELOAD to load a library that hides itself ...
9
you can install it locally in your home directory. Ususally it can be done by specifying the parameter prefix for configure script.
For example,
./configure --prefix=$HOME
So, when you compile sources configured in such way, then you will call ** make install** the binaries will install into you $HOME/bin
Also, you should alternate PATH variable.
You ...
8
I've successfully extracted the Fedora/OpenSUSE RPM into my home directory and ran chrome from there. You simply need to make sure that the symlinks for the libraries are all there. This assumes that the libraries area already installed, and $HOME/bin is in my $PATH.
I just ran:
mkdir ~/chrome; cd ~/chrome
rpm2cpio ...
8
This is a fundamental limitation of the unix permission model: only root can delegate.
You don't need to be root to run a virtual machine (not true of all VM technologies), but this is a heavyweight solution.
User-mode Linux is a relatively lightweight Linux-on-Linux virtualization solution. It's not that easy to set up; you'll need to populate a root ...
7
This is controlled by the PS1 environment variable. You can see what this is by running, as root, echo $PS1. You can then set the variable in your own bash profile with echo 'PS1=<value of PS1>' >> ~/.bashrc.
You can google for lots of possible values of PS1, but the part you are currently missing is \w for working directory.
6
It depends what you mean by "install". It is possible to extract the file contents of a .deb file using dpkg-deb -x <filename.deb>, but whether you can actually use the software after extracting it locally depends on how it is written. A lot of Linux software will be expecting to find its resource files in standard locations specified at compile-time, ...
6
If your system uses PAM, the login denial when /etc/nologin exists is triggered by the pam_nologin module.
You can skip the pam_nologin invocation for users matching certain criteria with pam_succeed_if. For example, if you want to allow users in the adm group to log in on a text console even if /etc/nologin exists, add the following line to ...
6
If you use D-Bus sessions and ConsoleKit (which is a default component of most modern desktop systems, so you may already have it installed), a system poweroff approach that is slightly cleaner than sudo shutdown and that does not require any sort of root privilege is:
dbus-send --system --print-reply --dest="org.freedesktop.ConsoleKit" \
...
6
Quoting access() manpage:
The check is done using the calling process's real UID and GID, rather
than the effective IDs as is done when actually attempting an
operation (e.g., open(2)) on the file. This allows set-user-ID
programs to easily determine the invoking user's authority.
Set-user-ID bit makes the process's effective UID equal to the ...
6
Your question implies that both programs would be running in alternation on the same machine, bound to the same port. This is a bad idea. You will run into the TIME_WAIT (a.k.a. 2MSL) problem if you try this. This article describes the problem. (It's Windows-centric, but most of what it's talking about applies to any TCP/IP stack.)
The BSD sockets API does ...
5
More similar Qs with more answers worth attention:
http://stackoverflow.com/q/3859710/94687
http://stackoverflow.com/q/4410447/94687
http://stackoverflow.com/q/4249063/94687
http://stackoverflow.com/q/1019707/94687
some of the answers there point to specific solutions not yet mentioned here.
(Actually, there are quite a few jailing tools with ...
5
Any real virtualization needs low-level access to the CPU, and thus root must install it. Once installed you don't need to be root to run it. You could probably install and run an emulator as non-root, such as bochs, or an adapter such as wine. If you have a specific Windows app in mind you could just run it under wine (maybe).
5
For KVM, you need access to the device /dev/kvm. If your user can read/write to this device, then you can run KVM-based virtual machines as your user.
For most other accelerated technologies, you will need kernel modules loaded (this includes virtualbox and VMWare). This almost certainly requires root-level access.
You can run non-accelerated ...
5
I was looking for a way to run a program with modified DNS resolution for testing purposes. For me, the solution was using the HOSTALIASES environment variable:
$ echo "foo www.google.com" > ~/my_hosts
$ HOSTALIASES=~/my_hosts wget foo
See hostname(7).
5
I think the best way to do this would be to set up a SOCKS5 proxy and tell firefox to send the DNS requests over the SOCKS5 proxy (network.proxy.socks_remote_dns). You could set up a socks5 proxy with openssh fairly easily (the -D option) and have a remote host running with a custom /etc/hosts, or something like DNSMasq for more complex DNS settings. ...
5
Use the --prefix option with the configure command.
I won't try to give a complete configure command here, since GCC is one of those programs most often given complex configuration options, but adding something like --prefix=$HOME/my-gcc-4.7 will work. Upon installation, you will get a tree under that directory containing things like bin/gcc.
Once it's ...
5
It's likely that
the list of users come from a network service: probably LDAP, maybe NIS if the network has been around for a very long time;
the home directories are automounted, i.e. mounted from some file server when the user logs in.
The file /etc/nsswitch.conf defines what sources provide user lists (the passwd setting).
The Solaris commands ...
5
Install and use sudo. It's the one and most sane way of doing these things. dhclient really needs root privileges, there's no way around it.
Allow specific users to execute a single command with root privileges. This can be configured in a /etc/sudoers file like this (edit using visudo):
Cmnd_Alias DHCP = /usr/sbin/dhclient
User_Alias DCHPUSERS = ...
4
Check out following question at superuser:
http://superuser.com/questions/184643/override-dns-in-firefox
If the discussed options and the SO link are not viable solutions then check out:
http://superuser.com/questions/100239/hostname-override-in-firefox
Especially check out:
https://addons.mozilla.org/en-US/firefox/addon/redirector/
It sounds like this ...
4
Beside the LD_PRELOAD tricks. A simple alternative that may work on a few systems would be to binary-edit a copy of the system library that handles hostname resolution to replace /etc/hosts with a path of your own.
For instance, on Linux:
If you're not using nscd, copy libnss_files.so to some location of your own like:
mkdir -p -- ~/lib &&
cp ...
4
AFAIK, There is nothing like that, and there is no reason to have something like that. There is a design problem if an admin think that he need a hosts file per user. Think about it: You can't hide a host just because you don't have it in /etc/hosts, you're reading more files when the system is initialized and maybe the difference between 2 users will be up ...
4
Generally it's best to use the least privileged user that can get the job done. Also, it's inevitable that you have to use the root account some time (even using sudo, which Ubuntu embraces, still counts as using root privileges).
There is no "you shouldn't use root", just "you shouldn't use root for normal tasks". For software development you should ...
4
User mode Linux is a Linux virtualization solution that runs entirely in userspace - no root privileges required.
However, it can only run a Linux guest within a Linux host, so it's not suitable if you want to run anything else.
4
Davfs2 isn't implemented like a normal FUSE filesystem. The Wikipedia page and the documentation mention that it can work on top of either Coda or FUSE, but the project description doesn't mention FUSE (and hints at native integration). The Debian package does not depend on FUSE, and the binary it ships only runs as root. This is not intrinsic to WebDAV, ...
Only top voted, non community-wiki answers of a minimum length are eligible
