How to deny a specific user access to an application?

Question

For the purpose of this question let’s attempt to deny user n the ability to play The Battle for Wesnoth (while still allowing users m and p to do so).

One obvious way to try to do this is to set permissions of relevant files (/usr/games/wesnoth* and the directory /usr/share/games/wesnoth) so that user n can neither execute them nor read them, while other users can.

As of now, the permissions of these files seem to be set as follows:

$ ls -l /usr/games/wesnoth-1.12
-rwxr-xr-x 1 root root 18325576 May 22  2016 /usr/games/wesnoth-1.12

Well, I’d suppose changing the ownership from user root to someone else wouldn’t be a good idea, so it’d seem I’ll have to mess with the group ownership instead…

I have basically two ideas:

‘Blacklisting’: Give the game’s files group noplay, and prohibit anyone with group noplay from using them:

sudo addgroup noplay
sudo adduser n noplay
sudo chown :noplay /usr/games/wesnoth* /usr/share/games/wesnoth
sudo chmod g-rx /usr/games/wesnoth* /usr/share/games/wesnoth

‘Whitelisting’: Give the game’s file group play, and prohibit others from using using them:

sudo addgroup play
sudo adduser m play
sudo adduser p play
sudo chown :play /usr/games/wesnoth* /usr/share/games/wesnoth
sudo chmod o-rx /usr/games/wesnoth* /urs/share/games/wesnoth

Is any of the above a good idea? Won’t changing the files’ group ownership from root to anything else make things awkward in the future? What if the game gets updated by the package manager – will it fail because of screwed permissions, or will it reset the permissions back to original, thus allowing all users to play the game?

If this matters, it’s Linux Mint here.

Answer 1

Linux Mint, being based on Debian, probably has the stat overrides feature. dpkg-statoverride allows you to configure the package manager to adjust filesystem permissions when a package creates files with a given path. For example, you can configure it to set permissions on /usr/share/games/wesnoth. The benefit to using dpkg-statoverride over manually setting the permissions is that the package manager will maintain the policy when you update or reinstall the package. You can read more about package permissions here, in section 10.9.

Whether you black or white list is up to you; choose whichever you predict will best match your use case. But in a nutshell, assuming whitelisting, you can do something like this:

dpkg-statoverride --add m play [mode] /usr/share/games/wesnoth

The tricky part is you'll need to use the octal representation for the mode. So you can't use the friendlier o-rx syntax.

Then, reinstall the app so that the permissions are applied.