Baslinux mailing list

[baslinux AT lists.ibiblio.org]

On Sun, 16 Mar 2008, baslinux AT lists.ibiblio.org wrote:

> This post will be a variation on the theme of trying to get a BL3 system
> working for non-root users--though in this case, the emphasis is more on
> security. The post is being made in light of general recognition on-list
> in past years that it's not very wise to be doing things on the internet
> (browsing, e-mailing) as root. Like my other recent posts, it is also
> being made in consideration of putting BL3 on a laptop I'll be getting
> soon.
>
> Sindi has posted in the past about setting up a BL3 system for
> unprivildged users. I have posted questions about this myself over the
> last few months. What I want to ask about now is a bit of a variation on
> that theme. It concerns a system where running as root most of the time
> would be fine--except in those instances in which programs need to go
> online. In those instances, I'm wondering if it is possible--and
> advisable--to run those programs not as root, but as an unpriviledged
> user. Feedback will be appreciated.

I start X as user before starting X programs as user. ptyp? and ttyp? and 
ttyS* and ttyLT* change their permissions spontaneously, so I chmod o+x 
the required devices in rc.  If I start X as root and then log in as user 
and try to start Opera, I get an error message (in BL2).  Fatal error on 
creating QT application object.  So I suggest starting X as user (you can 
load any required modules to connect to the internet first as root).

I am usually too lazy to actually run as user, but I do use a root 
password now.

I had to change a lot of permissions to get user working.
/tmp /home etc.

> So, presuming I've downloaded and installed passwd.tgz and have added an
> unpriviledged user, how can I, while being logged in as root, cause Opera,
> for example, to be started by my unpriviledged user? I can do it, of
> course, by opening a terminal, su'ing to the unprivildged user, then

If I try it this way (start X as root, su user, opera) I get a different 
error message from Opera.  Module initialization failure.  Generic 
failure.  I am running Opera from the directory where I unpackaged it, 
using a script cd /opera*, ./opera (to use their wrapper script).

Links 2 does work for su user.  Maybe it is the wrapper script part 
causing problems for me.

> issuing the command to start opera. But that's rather clunky. I'd rather
> be able to create an entry in jwm's menu that could simply be clicked on
> in order to cause Opera to be started by the unpriviledged user. I would
> like to be able to do the same with other internet-accessing programs such
> as links, Sylpheed, and naim. Any advice on how this could be done? Sample
> entries for jwm to offer? Please feel free to point out if and where my
> security notions may be confused--I don't lay claim to any high level of
> expertise in this area.

> I should mention that, with respect to Sylpheed, su'ing to the
> unpriviledged user in the terminal, then issuing sylpheed does not suffice
> (though it has worked fine with both Opera and links). When I try to do
> that, I get the error "bind: Permission denied." What might be the source
> of that problem and how might it be remedied?
>
> Thanks in advance for any input on this.
>
> James
>
> -----------------------
> BasicLinux mailing list
> -----------------------
> http://www.basiclinux.com.ru
> http://www.ibiblio.org/pub/linux/distributions/baslinux/
> ------------------------------------
> To exit, send subject=unsubscribe to
> baslinux-request AT lists.ibiblio.org

keesan AT sdf.lonestar.org
SDF Public Access UNIX System - http://sdf.lonestar.org