Arch equivalent of Debian `dpkg-divert`

Question

I am trying to configure Skype on Arch Linux to use a sand boxed user no matter which user calls skype, but I don't particularly like the use of a BASH alias to launch Skype as suggested by the wiki since as far as I can tell if a user is not using BASH or invokes Skype from skype.desktop, the sand boxed user will not be used. I thought it might be better to divert /usr/bin/skype to call

sudo -u skype /usr/bin/skype.real

where skype.real is the actual Skype binary. I am pretty sure in Debian I could do this with

dpkg-divert --package skype --add --rename --divert /usr/sbin/skype.real /usr/sbin/skype

and then add my own file to /usr/sbin/skype. How do I do this with Arch?

Answer 1

If as I suggested on the comments, the skype-restricted AUR package is not suitable for you (and note that I don't know the approach they use), I can think of two approaches:

(Read to the end for the correct way of applying them on Arch)

Change skype to a script that runs your real Skype

Create a bash script that will call your real Skype:

#!/bin/sh
sudo -u skype /usr/bin/skype.real

Give it execute permissions and save it as /usr/bin/skype, renaming the old Skype binary to /usr/bin/skype.real.

This approach leads a few things that needs consideration though:

• If you really want noone calling Skype (the real one) other than the skype user, you need to give the file the appropriate permissions:

  chown skype /usr/bin/skype.real
  chmod 0100 /usr/bin/skype.real
  

  This will avoid anyone but its owner to run it

• In order to let anyone run skype (the new, scripted one), you need to edit the sudoers file (using visudo) so anyone (preferrably in a group, possibly group skype) can call it as user skype. I don't know the details, I just know it can be done.

Change skype owner and set the setuid bit

Note: This is not the recommended way, as setuid executables should be set to a minimum

This migh be cleaner possibility can be setting the setuid bit so anyone calling skype calls it as the user skype.

chown skype /usr/bin/skype
chmod u+s /usr/bin/skype

This will make the skype command available as always, but it will always be run as the skype user.

---

In any of the above cases, any time you update Skype to a newer version you will need to repeat the process, as pacman will replace the binary.

The solution is to create a PKGBUILD that downloads the official package, extracts it and performs the desired changes. Then you install it manually (as you would install any AUR package). You will need to re-build it manually any time you need to update. Skype doesn't update that often though.

For this las one task, the official wiki on PKGBUILDs are a great resource.