Classifying User Rights to use Programs

[haries]

Dears,

I want to classify my users, based on what kind of programs/binaries they can use.

Users of group Bronze, can use programs
A, B and C

While users of group Silver can use programs of Bronze, in addition
D and E

While users of group Gold can use programs of Silver, in addition
F, G, H

Any Idea on how to do this?
I am curious on how sdf.lonestar.org is doing this...



Thanks in advance.

Best Regards,
ries

[robertdaleweir]

Hi haries
The affect you are trying for can be done in several different ways. One way is to first create three groups bronze, silver and gold. (groupadd or use the System->Administration->Users and Groups {:not knowing which distro you use, your mileage may vary} . You would add A, B and C to only the bronze group. Add D and E to the both the silver group and the bronze group and add F,G and H to the gold, silver and bronze groups.
Create a user called bronzeprograms and make it a member of the the group bronze only. Make a user called silverprograms and make it a member of group silver only. Similarly with gold.
Now make the owner of the programs for group bronze be user bronzeprograms and programs for silver owned by user silverprograms and similarly for gold.
Now you have restricted access to the programs to the groups who have the members (users) that have the various permissions you set out.
If user A tries to run a program in the silver group he will not have permissions. But all users in silver group can run both bronze programs and silver programs because they are members of both and so on.
Remember all this must be done as root, or no joy. This is only one approach and I do not profess it to be the most elegant approach, but it may serve your needs.
As new users come along all you need to do is add them to the proper group (or groups) and their access rights should be automatically correct.
The programs of course must have executable privileges to both the owner (ie. bronzeprograms) and the group(s) they belong to (ie. bronze). Permissions for programs owned by the user, in this case, bronzeprograms should be (-rwxr-x---). In this case they are members of only one group, bronze.
Hope this helps. Cheers...
Robert

[haries]

Thanks Robert.
I understand.. it is very helpful.