<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 18px; font-family: Calibri, sans-serif;">
<div>Hi John,</div>
<div><br>
</div>
<div>Thanks! I was not aware of LTSP, will take a look.</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>
<div>-- </div>
<div>Grigory Shamov</div>
</div>
<div>Westgrid/ComputeCanada Site Lead</div>
<div>University of Manitoba</div>
<div>E2-588 EITC Building, </div>
<div>(204) 474-9625</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Roundtable <<a href="mailto:roundtable-bounces@muug.ca">roundtable-bounces@muug.ca</a>> on behalf of John Lange <<a href="mailto:john@johnlange.ca">john@johnlange.ca</a>><br>
<span style="font-weight:bold">Reply-To: </span>Continuation of Round Table discussion <<a href="mailto:roundtable@muug.ca">roundtable@muug.ca</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, February 2, 2017 at 6:41 PM<br>
<span style="font-weight:bold">To: </span>Continuation of Round Table discussion <<a href="mailto:roundtable@muug.ca">roundtable@muug.ca</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [RndTbl] limited Linux Desktop?<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">The Linux Terminal Server Project was geared toward this, but it now appears un-maintained since 2013, which is fine because it's not a download but built into the distributions that support it.
<div><br>
<div><a href="http://www.ltsp.org/">http://www.ltsp.org/</a><br>
</div>
</div>
<div><br>
</div>
<div>Perhaps you are already aware/using it, but if not you might be able to get some useful ideas.</div>
<div><br>
</div>
<div>Alternatively, you could spin a new virtual machine for each desktop which is actually more typical way this is done these days. It requires more resources, the trade off is better security, though they could still navigate around the file system.</div>
<div><br>
</div>
<div>John</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Feb 2, 2017 at 5:24 PM, Trevor Cordes <span dir="ltr">
<<a href="mailto:trevor@tecnopolis.ca" target="_blank">trevor@tecnopolis.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 2017-02-02 Grigory Shamov wrote:<br>
> Hi All,<br>
<span class="">><br>
> somehow locked to the particular users and perhaps even particular<br>
> apps?<br>
<br>
</span>Particular users can probably be handled with custom pam<br>
rules/settings. Particular apps is much harder. I think you'd need to<br>
create an install (perhaps virtual) that just has the apps you want<br>
those users to use.<br>
<span class=""><br>
> I.e., so that any Filemanager would stay under selected paths the<br>
> user has access to?<br>
<br>
</span>That's chroot-y if you want the OS to only show the user what's<br>
in /home/foo in a secure way. However, there's no chroot method that<br>
will lock them in one data path without requiring copies of the<br>
relevant bins/libs/etc for the apps you want to run. I don't even<br>
think any of the recent developments like cgroups, docker, etc, can<br>
help you here.<br>
<br>
Even trying to hardlink everything into a chroot environment under the<br>
user's home dir wouldn't work I don't think because of the complexity<br>
of login managers, and X in general.<br>
<br>
Now you might be able to find a file manager that can be set to limit<br>
views to certain paths, but without something at the OS layer locking<br>
things down they can always escape somehow if they know what they are<br>
doing (or bring up a shell).<br>
<br>
If I'm understanding what it is you're trying to do correctly, I'm<br>
afraid there may be no solution. However, if you perhaps redefine your<br>
policy goals of what exactly you're trying to protect against, perhaps<br>
you can achieve those goals without locking things down as drastically<br>
as you think you need to.<br>
______________________________<wbr>_________________<br>
Roundtable mailing list<br>
<a href="mailto:Roundtable@muug.ca">Roundtable@muug.ca</a><br>
<a href="https://muug.ca/mailman/listinfo/roundtable" rel="noreferrer" target="_blank">https://muug.ca/mailman/<wbr>listinfo/roundtable</a><br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr">
<div>John Lange<br>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>