Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How to make one user account to be like root for some other user account, e.g. to be able to read, write, chmod all it's files, chown from this account to master and back, kill/ptrace all it's processes and to all thinks root can, but limited only to that particular slave account?

Now I'm simulating this by allowing "master" user to sudo -u slaveuser and setting setfacl -dRm u:masteruser:rwx ~slaveuser.

It is useful as I run most desktop programs in separate user accounts, but need to move files between them sometimes.

If it requires some simple kernel patch it is OK.

P.S. tag "selinux" doesn't mean I want to solve it using SELinux, it is just somewhat related.

share|improve this question
    
Not per se. See SELinux. –  Ignacio Vazquez-Abrams Jun 15 '10 at 21:46
    
@Ignacio Vazquez-Abrams, Can SELinux do it simply (without intrusion to much of other things or dealing with it's complex configuration files)? –  Vi. Jun 15 '10 at 21:57
    
Why don't you just give the user sudo access? Then they can run root commands at will by just typing sudo before them (it prompts them for their own password when they do this). This is a much more normal solution. It is generally not recommended to run desktop programs as root or with root like privileges. If your desktop applications require special permissions to certain files then you should just set that up specifically. –  Jarvin Jun 15 '10 at 22:07
    
It won't be trivial with SELinux. It simply provides a possibility of making your scheme work. –  Ignacio Vazquez-Abrams Jun 15 '10 at 22:15
    
@Dan Bad comment. Master user already can "sudo" (not to root, but to slate accounts). The programs are already running separate non-root accounts. But there should be one account to rule them all. I don't want this "One Account" to be root, as I run some programs there too. –  Vi. Jun 15 '10 at 22:49

1 Answer 1

The traditional unix security model simply doesn't support what you want. root can do everything, and all other users are created equal. Complex relationships between users tend to require a lot of work from root.

One possible approach is to recreate your own Linux system inside a virtual machine of some kind, either with a linux-on-linux approach such as User Mode Linux or VServer, or with a generalist virtual machine such as qemu/kvm or virtualbox. Inside the VM, you would have root access, and be able to comfortably run each application as a different user.

You could even run each application in a separate lightweight virtual machine (VServer is probably the most suitable for this). The OLPC (one laptop per child) project tried it, and found performance satisfactory but later discarded the idea, I don't know why (perhaps sharing data between applications was too cumbersome?).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.