Our class is finally installing Mint Linux on our machines. The problem is our teacher is scared that we'll play war games against the two classes that use the computers. His solution is to install two separate operating systems; due to that fact, that we will need sudo ability, but he doesn't want us to be able to break the OS for the other person (by either playing war games or by making mistakes). His solution is to install two separate operating systems, but I dislike this idea for a couple of reasons. First, we have MBR, so that limits the number of partitions; and second, it's just annoying because they are both Mint Linux, so we'll choose the wrong one a good deal of the time. Anyone know of a way of separating the two operating systems so one person can't screw it up for the other? I'm less worried that we'll play war games because we could do this with the separate partitions and because it's less important. Anyone have any ideas?

I was thinking of limiting the power a user has while still allowing them to use root; however, this could cause problems later on. The teacher wants to control the root account of course.

  • 1
    please add to your question all (!) the reasons you need root acces for. that's key to selecting the correct method. in general you cannot have a restricted user with full access. – Bananguin Apr 9 '13 at 21:09

There are two obvious answers:

  1. Give each user his own virtual machine image. Inside the virtual machine, the user has root access; outside the virtual machine, none at all. If your hardware supports it, kvm will work pretty well for this. And virtual machine images are just files, so they're easy to copy around, etc. You can use copy-on-write storage, which will save some disk space, if that's a concern.
  2. Use the newfangled namespaces support in Linux 3.8, which actually allows everyone on the machine to have root in his own area. Depends especially on what you need root for. (Though, you can actually run an entire separate distro inside a namespace, it just has to share the same kernel).

Unlike separate partitions (which are very easy for root to mess with—just mount it), the above two actually are secure (well, you have physical access to the machine, so those vulnerabilities apply regardless).

There are more painful things too, like capabilities and SELinux, depending on why you need root (sudo) access. Or, of course, if you just need a command or two, sudo has built-in support for limiting which commands may be run.

edit: For more information on namespaces, see Namespaces in operation, part 1: namespaces overview, which has six parts in total. Namespaces have been going into Linux slowly, starting several years ago. Part 5 and 6 cover the final part, added in 3.8, which allows any random user to have root in his own namespace.

| improve this answer | |
  • Can you provide a link for the “new namespace” feature? I've never heard of that and it sounds interesting. – Marco Apr 9 '13 at 18:09
  • @Marco added a link into the question which explains them – derobert Apr 9 '13 at 18:13

Instead of installing two versions of the same OS, the teacher can just set it up once with the root filesystem on a logical volume then set up grub to boot from two different snapshots of that one LV. He can put your names in the boot entry so it's easy to pick, set a password on grub, and disable the grub timeout (so you don't feel rushed to pick something). He'll just need to make sure the snapshot has enough space to cover what you guys are going to do with it.

If he need to update the referenced LV he can edit the command line on one of the other entries (after entering his password) and just change root= in the kernel args to be the actual LV instead of a snapshot.

This would do what he's wanting in a little more resource-conscious way, but ultimately it's a bad idea.

Ultimately, I'd try to explain to him that with LiveCD's he's probably peeing in the wind, if you guys are wanting to do that, installing to two different partitions or booting from a snapshot doesn't stop you, it just changes the exact steps you'll go through to do it.

| improve this answer | |
  • Keep in mind that updating the referenced LV does not update the snapshots. The snapshots change fully independently of the underlying volume. – derobert Apr 9 '13 at 17:41
  • This is true, but one would hope that the teacher will make sure the referenced LV is good to go for the activities planned for the class. As long as the installed OS isn't a new release He only needs access to the referenced LV to do updates between classes to do system updates and to delete/create the two student snapshots. – Bratchley Apr 9 '13 at 18:28
  • I used to do this myself back in the day, it basically gets you to the point of being able to royally mess your whole system up and be able to rollback to something that works again in a matter of minutes. – Bratchley Apr 9 '13 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.