Creating Password For Wine?

[joelandsonja]

I am trying to figure out how I can restrict other people who use this computer from installing programs with wine.

Here's what I did so far:

- Clicked on 'Browse c:\ Drive' in the Wine Directory
- Right clicked on 'Program Files'
- Clicked on The 'Permissions' Tab
- Set permissions to 'Access Only'

Now, the only problem is that anyone can just right click and reset the permissions so they can install a new program.

What I am hoping for is to set a password for changing the Permissions ... can this be done?

Thanks for the help!

[joelandsonja]

Any thoughts?

[D-cat]

Not to mention that they could also simply install a program to a different directory.

Does each user have their own account on the computer, or are you all using one master account?

This is a difficult one to tackle because while restricting access to a given program (like wine) to certain user accounts is fairly elementary, selectively limiting a program's access within a user's own directory isn't quite so.

The best I can suggest in this stage (assuming everyone uses the same default account) is to actually change the ownership of the entire directory structure in ~/.wine/drive_c to root:root with 644 permissions on the files, 755 on directories. This will prevent anything from being written by users until the ownership is restored to the current user (requires sudo and password). It should effectively prevent wine installs (though they could still attempt z:\tmp), but will likely also prevent normal operation of some already installed programs. It will become a balancing act.

A more permanent solution involves careful planning and the creation of new groups, keeping each user in their own account (you can have them share the same virtual C: drive if you want), then you can manage what directories a user can write to in wine (as existing programs require) and which ones are read-only to them by assigning directory group ownerships and permissions.

There isn't really a perfect solution to this. Wine itself just wasn't designed to be that selectively restrictive. It doesn't distinguish an installer exe from any other program executable, so really wine execution is an all or nothing thing, and restricting directories can only have a limited effect. I'll sleep on ideas tonight.

[joelandsonja]

Thanks for the reply, I'll try to give your ideas a shot.