[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: some kind kiosk system



on Fri, Jul 23, 2004 at 08:15:36AM -0400, Steve Glines (sglines@is-cs.com) wrote:
> Karsten M. Self wrote:
> 
> > on Fri, Jul 23, 2004 at 01:13:53AM -0700, Paul Johnson (baloo@ursine.ca) wrote:
> > 
> >>Justinas <justinas.g@patikimi.lt> writes:
> >>
> >>
> >>>	There is an computer game club with 49 computers running
> >>>linux. I would be glad to hear any suggestions how to build entirely
> >>>system that forbids users to execute any other programs or scripts,
> >>>only games, browsers and some office programs. The main aim of this,
> >>>to keep computer out of trash and make administrators life
> >>>easer. Could somebody share experience on some kind computer kiosk
> >>>systems. Any suggestions, critics are acceptable.
> >>
> >>Don't install more than you need installed.  That'll get you about 90%
> >>there.  The last 10% can be taken care of with groups and file
> >>permissions, or if you want to overkill it, the ACL permission support
> >>in 2.6 might be of help (however, I don't use ACL support, don't know
> >>how well it works, and have more or less been waiting for success or
> >>horror stories which have yet to materialize from what I've seen).
> > 
> > 
> > ...user state in ramdisk and/or copied into the user's account at
> > startup.  And a watchdog to slay the user if critical files disappear or
> > are changed.
> > 
> > One of the better descriptions I've seen of a Linux Kiosk configuration
> > is JWZ's DNA Lounge systems.  San Francisco nightclub, typically filled
> > with several hundred highly individualistic patrons under varying
> > influences astrological to zoological, and overall both reliable and
> > usable.  GIYF.
> 
> Just invoke users shell as bash -r

Not sufficient.

RTFM.  You'll find that the restrictions within a restricted bash shell
are dropped when executing shell scripts.  Which is a handy way for
doing various things.  And hence, rather limiting.

I'd look at a chroot or UML jail for additional security.


Peace.

-- 
Karsten M. Self <karsten@linuxmafia.com>        http://linuxmafia.com/~karsten
    Ceterum censeo, Caldera delenda est.



Reply to: