Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Made a guest account for a friend to access my machine and restricted him to a very small set of permissions. That seems to work as expected using ssh, when running id and groupsthe correct groups are being shown, both invoked as root and as a user. su ing also works as expected, guest group is the only one he belongs to.

All of that works when I ssh into my machine from the same machine, as well.

However, if I log in using a virtual terminal on that same machine with his account, and run id then he's in audio, cdrom, scanner, floppy and all that.

Distribution is Slackware 13.37 (updated to current), if it helps.

share|improve this question
How did you restrict him in this way? – Daniel Andersson Jun 17 '12 at 16:10
@DanielAndersson I simply only made him a member of the 'guest' group and nothing else. I have yet to learn how to jail a user in his home properly, I don't mind him exploring the filesystem, but I have some disks mounted in media I don't want anyone snooping around in. So I put the requirement of being a part of the disk group to access those, which my friend does not belong to, and while the supplementary console groups don't include the disk one, they contain the audio one, and with that he would have been able to change my alsamixer settings, but that is sorted out now. – Erius Jun 18 '12 at 16:03
@DanielAndersson Not that he 'really' would have been able to change my audio settings since it only applies to VT login at my physical computer, but at time of posting this question I had no idea about that, obviously, hehe. – Erius Jun 18 '12 at 16:05
up vote 1 down vote accepted

Found the file that causes it.



CONSOLE_GROUPS         floppy:audio:cdrom:video:scanner

Paraphrasing the comments regarding this setting:

The supplementary groups specified are only added to the user when logging into a shell with /bin/login, not when using a login manager such as kdm.

This explains the behavior since the VTs accessed with control alt F1 to F6 operate this way.

The comments also advise to disable supplementary console groups and add the users who need hardware access to the respective groups with adduser, useradd or editing /etc/group/ directly.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .