Russ Allbery writes:
> Paul Farber <[EMAIL PROTECTED]> writes:
>
> > Again, this is a security issue, not a single/multi user issue. It
> > should be difficult to delete or modify a .dll/exe program file.
>
> > You SHOULD have to type into a special "admin" account to install/remove
> > a program. Single user or not.
>
> While this may very well be a good idea, I'm not aware of any Unix which
> requires this, provided that the program doesn't want to talk on
> priveleged ports or have access to raw hardware.
>
Hi Russ. Actually, we used to do just that. That was what /usr/local/*
was all about. The executables (and the /usr/local directory
structure,) were owned by other than UID GID root or bin. There was a
special UID and GID for everything in /usr/local. (Its been too long,
I can't remember the UID GID.)
If a program required HW access, or a socket, it had to be
chown/chgrp'ed to root/bin by the sysadmin. So, a group of non-admin,
high level users could manage the /usr/local stuff, install/upgrade
new programs, blah, blah. You could, also, upgrade the system without
risk of overwriting the users programs and config files.
I have no idea why we dropped the concept. Probably a casualty in the
name of user friendly.
John
--
John Conover, 631 Lamont Ct., Campbell, CA., 95008, USA.
VOX 408.370.2688, FAX 408.379.9602
[EMAIL PROTECTED], http://www2.inow.com/~conover/john.html
