I'm trying to write a script which prevents the concerned user from opening programs (mostly internet browsers) from being run during a certain time (like 1000 to 1200 hrs). This is like a productivity suite. I don't have much problems implementing the timing problem or the user problem. My problem lies in the prevention of task execution.

My question is: How do I stop a process before it starts?

Right now, I have an infinite loop implementation with a pseudo-code as :

killall midori
killall firefox

But this is taxing on the computer and I don't want to stop a task if it starts, I want to prevent the task from starting in the first place.

  • What kind of stupidity is this? Your administration power made you feel like fascist fuhrer? If you need to prevent people executed a program, change owner-group and remove appropriate permission. Much better would be to define what is permitted inside a proxy (like squid). If you would kill my browser while I would be doing a work and I would lost data, I would escalate you and let you be fired ASAP! – jirib Apr 10 '12 at 13:20
  • LOL. I re-read my question and I think I misled the audience, I am actually designing this as a productivity suite. – user14517 Apr 10 '12 at 13:28
  • 2
    If the user does cp `which midori` ~/mybrowser then your killall midori will solve nothing. This also stands for the permission manipulation mentioned by @Jiri. – manatwork Apr 10 '12 at 13:41
  • 1
    Filesystems can be mounted noexec ;) – jirib Apr 10 '12 at 13:48

There are several methods:

  1. Remove the executables that you want to limit from locally attached storage on all workstations and make them accessible only on a network drive that you control

  2. Use SELinux policy to limit execution per workstation

  3. Limit access to the ports, IP addresses or other resources that the offending executables need using proxies or just iptables

None of these methods will be effective without first implementing a well explained usage policy agreement that users must sign.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy