0

For the purpose of this question let’s attempt to deny user n the ability to play The Battle for Wesnoth (while still allowing users m and p to do so).

One obvious way to try to do this is to set permissions of relevant files (/usr/games/wesnoth* and the directory /usr/share/games/wesnoth) so that user n can neither execute them nor read them, while other users can.

As of now, the permissions of these files seem to be set as follows:

$ ls -l /usr/games/wesnoth-1.12
-rwxr-xr-x 1 root root 18325576 May 22  2016 /usr/games/wesnoth-1.12

Well, I’d suppose changing the ownership from user root to someone else wouldn’t be a good idea, so it’d seem I’ll have to mess with the group ownership instead…

I have basically two ideas:

‘Blacklisting’: Give the game’s files group noplay, and prohibit anyone with group noplay from using them:

sudo addgroup noplay
sudo adduser n noplay
sudo chown :noplay /usr/games/wesnoth* /usr/share/games/wesnoth
sudo chmod g-rx /usr/games/wesnoth* /usr/share/games/wesnoth

‘Whitelisting’: Give the game’s file group play, and prohibit others from using using them:

sudo addgroup play
sudo adduser m play
sudo adduser p play
sudo chown :play /usr/games/wesnoth* /usr/share/games/wesnoth
sudo chmod o-rx /usr/games/wesnoth* /urs/share/games/wesnoth

Is any of the above a good idea? Won’t changing the files’ group ownership from root to anything else make things awkward in the future? What if the game gets updated by the package manager – will it fail because of screwed permissions, or will it reset the permissions back to original, thus allowing all users to play the game?

If this matters, it’s Linux Mint here.

2
  • I think a better why would be to use Linux extended permissions (ACL) to fine tune the permission per user/group/dir, see here, wiki.archlinux.org/index.php/Access_Control_Lists
    – Rabin
    Jan 5, 2017 at 14:21
  • Actually You can add/remove group of games. You can remove group of games from user or add group of games for user. Can play or not based on group.
    – supriady
    Jan 5, 2017 at 15:32

1 Answer 1

1

Linux Mint, being based on Debian, probably has the stat overrides feature. dpkg-statoverride allows you to configure the package manager to adjust filesystem permissions when a package creates files with a given path. For example, you can configure it to set permissions on /usr/share/games/wesnoth. The benefit to using dpkg-statoverride over manually setting the permissions is that the package manager will maintain the policy when you update or reinstall the package. You can read more about package permissions here, in section 10.9.

Whether you black or white list is up to you; choose whichever you predict will best match your use case. But in a nutshell, assuming whitelisting, you can do something like this:

dpkg-statoverride --add m play [mode] /usr/share/games/wesnoth

The tricky part is you'll need to use the octal representation for the mode. So you can't use the friendlier o-rx syntax.

Then, reinstall the app so that the permissions are applied.

1
  • Kind thanks to You. Too bad syntax like dpkg-statoverride --add root games 0750 /usr/games/wesnoth* doesn’t work though… This asterix can be sometimes very helpful.
    – gaazkam
    Jan 7, 2017 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.