Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to create a user in Fedora Linux(15) which only has privileges to print documents.

Our college issues a printer to each lab and I need to create a new user on my Fedora which only has privileges to print.

Network sharing is not an option, so is there any way by which I can a restrict a user from executing any commands except the necessary printing commands?

share|improve this question
    
... do things like Xorg count, or are you just logging in under a TTY and running lpr? –  new123456 Aug 5 '11 at 13:43
add comment

2 Answers

I"m not sure if it's still used and tested much, but shells used to have a restricted shell option which might help what you need. It severely limits what a shell can break.

I'd consider a vmware instance or a chroot jail for this, both might be a lot of work.

share|improve this answer
    
So for the user's shell setting would it be set to /bin/bash -r? –  Mike Keller Aug 5 '11 at 16:22
1  
@Mike Keller - better would be /bin/rbash. You'd need to be root and either make a hard link or symlink from bash => rbash. Then set up their environment to be VERY restrictive. –  Rich Homolka Aug 5 '11 at 16:33
    
Cool thanks for the info Rich. –  Mike Keller Aug 5 '11 at 16:57
    
Also as far as using a chroot jail, I've run across Jailkit before and didn't think about it till just now as I was re-reading your answer. That might simplify the process. –  Mike Keller Aug 5 '11 at 17:04
add comment

You will have to create a new group and a new user. Assign the new user to that group only. Chown the printing commands to the new group.

I'd then recommend building out a script of some sort that then runs the commands needed as that printer only user transparently to the end user... if that made any sense.

share|improve this answer
    
Unfortuntately even this can't stop everything. You'd have to change every executable to not have execute for 'other' and change every file and every non-temp dir to not have write for 'other'. That may cause bigger problems. –  Rich Homolka Aug 5 '11 at 15:58
    
I don't know if I'm following what you are saying. So long as the new user isn't assigned to any other groups than the new one they shouldn't be able to access any other executables as they should be attached to other system and user groups. (This is purely informational for me, not trying to be argumentative.) –  Mike Keller Aug 5 '11 at 16:19
1  
I think you're forgetting 'other'. Yes, they won't be the user, or group, but other is everyone else. They'd get those 'other' perms. Anything with other-write would be writable, anything with other-executable would be runnable. –  Rich Homolka Aug 5 '11 at 16:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.